Rhysida — Ransomware Profile
Rhysida is a ransomware-as-a-Service operation that emerged in 2023, notably attacking government and healthcare sectors including UK NHS trusts.Also tracked as
Vice Society (operational successor / shared operators), Rhysida ransomware
IntelFusions coverage (1)
- New ransomware crew Za Woo opens with 10 German victims 2026-08-30 · Ransomware
Tools & malware
- AnyDesk remote access tool
- Cobalt Strike post-exploitation/C2
- MegaSync Exfiltration tool
- ntdsutil credential dumping (NTDS.dit)
- PortStarter backdoor (Go script)
- PowerView AD reconnaissance
- PsExec lateral movement / execution
- Rhysida ransomware/encryptor
- SILENTKILL PowerShell defense-evasion script
- SystemBC proxy/backdoor implant
- WinSCP File transfer utility
Recent claimed victims
- Kreishandwerkerschaft Borken 2026-09-19
- MPA Pharma 2026-09-18
- Axdia International 2026-09-12
- General Santos Doctors Hospital 2026-09-10
- Professional Retail Services 2026-09-10
- SAD'S Interim 2026-09-08
- Rug & Home 2026-09-07
- Szechenyi Programiroda Nonprofit Kf 2026-09-01
- Valley Health Team 2026-08-28
- Berlin, Germany 2026-08-28
- CRI Electric 2026-08-22
- Battle Creek Public Schools 2026-08-21
- Fairview Dental Group 2026-08-21
- Pierce Township 2026-08-14
- SIA Medical Centre 2026-08-13
- Lawson Roofing 2026-06-18
- IDS Group 2026-05-25
- Landeshauptstadt Stuttgart 2026-05-19
- Tower View Primary School 2026-05-15
- Stelia North America 2026-04-27
- Southold Town Senior ServicesSouthold Police Department 2026-03-02
- Rohner 2026-02-23
- Cheyenne & Arapaho Tribes 2026-02-17
- Phoenix Art Museum 2026-02-12
- Leading Edge Speciali 2026-02-06
Vendor research
- Investigating the New Rhysida Ransomware Fortinet FortiGuard Labs
- Rhysida Ransomware: In-Depth Analysis, Detection, Mitigation SentinelOne
- Protection Bulletin: Rhysida ransomware Symantec (Broadcom)
- #StopRansomware: Rhysida Ransomware (AA23-319A) CISA / FBI / MS-ISAC
- An Overview of the New Rhysida Ransomware Trend Micro
- The Rhysida Ransomware: Activity Analysis and Ties to Vice Society Check Point Research
- Ransomware Spotlight: Rhysida Trend Micro