Loading malware…
Rhysida is a ransomware family and ransomware-as-a-service operation first observed in May 2023. It employs double extortion, combining file encryption with theft of sensitive information and threats to publish stolen data. Its operators target organizations globally, particularly healthcare, education, government, and other public institutions, with additional victims in manufacturing, technology, and entertainment. Rhysida has been associated with Vice Society, also tracked as Vanilla Tempest, Rapid Brigantine, and VICE SPIDER; that actor has used multiple ransomware families rather than Rhysida exclusively.
Rhysida intrusions have used phishing, compromised VPN accounts lacking multifactor authentication, purchased remote-access credentials, and exploitation of external services. An investigated Windows intrusion began with SEO poisoning that directed a user to a trojanized PuTTY download. Campaigns associated with Rhysida operators have also used ClickFix and TerminalFix lures, including fake CAPTCHA pages that persuade users to execute malicious commands. These delivery chains can employ separate loaders and tunneling tools before ransomware deployment.
Observed operations include network enumeration, RDP-based lateral movement, persistence, and data exfiltration to attacker-controlled cloud storage using AzCopy. Pre-encryption scripts have attempted to disable security products, stop database and backup services, change local account credentials, enable remote administration, delete backups and shadow copies, disable recovery, and clear event logs and command histories. These preparatory actions facilitate ransomware deployment and obstruct detection and recovery. Stolen information is published through a leak site when extortion demands are not met.
A weakness in the random-number generation used by earlier Rhysida variants enabled development of a free decryptor; its availability does not establish that newer variants are recoverable.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In other cases, the group exploited vulnerabilities such as Zerologon, a privilege escalation flaw in Netlogon Remote Protocol (CVE-2020-1472). | The Rhysida group has been observed using compromised valid VPN credentials to gain initial access to their victims, notably due to accounts lacking MFA.
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The tradecraft has previously been attributed to Vice Society, a cybercriminal group associated with several ransomware families, including Rhysida.
Vice Society, which has operated several ransomware families, including Rhysida recently.
The Rhysida group has been observed using compromised valid VPN credentials to gain initial access to their victims, notably due to accounts lacking MFA.
This group has been linked to the Vice Society and Rhysida ransomware families.
The Rhysida and Interlock groups, which are known to attack healthcare and other critical infrastructure, have similar TTPs and encryption binaries, leading to some speculation of a connection between the two groups.
Associated malware includes Rhysida ransomware, Lumma Stealer, Vidar infostealer, and the Oyster (Broomstick) backdoor.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
The Broomstick/Oyster chain "created persistence through a scheduled task called: AlphaSecurity"; Rhysida also supports "-S create a scheduled task running as SYSTEM."
Vanilla Tempest submitted "trojanized Microsoft Teams installers," distributed through legitimate advertising and fraudulent download pages; IBM documented "MSteamsV7.80.exe."
"Berlin’s state government has launched a major review after ransomware attackers published data stolen from two government departments."
The recommended high-confidence impact correlation includes "vssadmin / shadow deletion."
65 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
129 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family mentioned as background on Vice Society's associations. The content does not establish that Rhysida was deployed or intended for deployment in the investigated incident.
Named as ransomware associated with Vice Society, providing background for the suspected ransomware objective. The article does not establish that Rhysida was delivered, executed, or the intended final payload in this incident.
Ransomware family cited as recently operated by Vice Society, also identified as Rapid Brigantine. The investigated incident was contained before ransomware deployment, and Rhysida is not identified as an observed payload in that incident.
Ransomware associated with the December 2023 attack targeting Sony and Insomniac. The attack reportedly resulted in 1.7 TB of stolen data, including an early Wolverine build and source code subsequently used to develop an unofficial PC port. The article does not describe the malware's technical behavior.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.