Rhysida — Ransomware Profile
Rhysida is a ransomware-as-a-Service operation that emerged in 2023, notably attacking government and healthcare sectors including UK NHS trusts.Also tracked as
Vice Society (operational successor / shared operators), Rhysida ransomware
IntelFusions coverage (8)
- Brazilian state health agency hit, then named on leak site 2026-11-08 · Cyber Incidents
- Mexico's leak-site claims climb back to their August peak 2026-11-01 · Cyber Incidents
- Ransomware share of Talos IR cases climbs to 27% 2026-10-29 · Ransomware
- Malaysia draws six different extortion crews in one week 2026-10-29 · Cyber Incidents
- Lamashtu extortion crew turns its leak site on Germany 2026-10-26 · Cyber Incidents
- Vietnam's Mat Bao and Thai Lion Air land on leak sites 2026-10-04 · Cyber Incidents
- Fake fix prompts plant covert tunnels on Windows PCs 2026-09-30 · Cyber Incidents
- New ransomware crew Za Woo opens with 10 German victims 2026-08-30 · Ransomware
Tools & malware
- AnyDesk remote access tool
- Cobalt Strike post-exploitation/C2
- MegaSync Exfiltration tool
- ntdsutil credential dumping (NTDS.dit)
- PortStarter backdoor (Go script)
- PowerView AD reconnaissance
- PsExec lateral movement / execution
- Rhysida ransomware/encryptor
- SILENTKILL PowerShell defense-evasion script
- SystemBC proxy/backdoor implant
- WinSCP File transfer utility
Recent claimed victims
- Tribunal de Justica do Estado de Minas Gerais 2026-11-07
- Treuhand & Immobilien Abt AG 2026-11-07
- El Cajon, CA 2026-11-04
- Juge, Napolitano, Ruli, Putfark & Pittman 2026-11-04
- Here at Pope and Johnson County Title Company 2026-11-03
- Phoenix Charter Academy 2026-10-31
- INTI International University & Colleges 2026-10-30
- Cipsa Industrias Sa De Cv 2026-10-30
- INTAX, Inc. 2026-10-29
- ClaimTek Systems 2026-10-29
- Noelker and Hull 2026-10-28
- Broadstreet HEOR 2026-10-28
- Machelen (Belgium) 2026-10-27
- MISC Group 2026-10-26
- Line2Line Coatings 2026-10-23
- Sanders Law Group 2026-10-23
- DR.SCHNELL GmbH & Co. KGaA 2026-10-22
- Reed & Giordano PA 2026-10-11
- Charles E. Tabor AAL LLC 2026-10-11
- Gress Clark Young & Schoepper 2026-10-10
- Anne Arundel County 2026-10-09
- RealManage 2026-10-09
- Skaff Group 2026-10-03
- Electro Heat Sweden AB 2026-10-02
- Mat Bao Corporation 2026-10-02
Vendor research
- Investigating the New Rhysida Ransomware Fortinet FortiGuard Labs
- Rhysida Ransomware: In-Depth Analysis, Detection, Mitigation SentinelOne
- Protection Bulletin: Rhysida ransomware Symantec (Broadcom)
- #StopRansomware: Rhysida Ransomware (AA23-319A) CISA / FBI / MS-ISAC
- An Overview of the New Rhysida Ransomware Trend Micro
- The Rhysida Ransomware: Activity Analysis and Ties to Vice Society Check Point Research
- Ransomware Spotlight: Rhysida Trend Micro