rhysida

Executive Summary

Rhysida, a ransomware-as-a-service (RAAS) group emerged in May 2023, utilizing phishing and Cobalt Strike for network breaches. Their campaigns target various sectors globally, leaving '.ryshida' file extensions and demanding Bitcoin ransoms, with threats of data distribution as leverage.

Goals & Targeting

Rhysida's primary goal is financial gain. Their targeting strategy focuses on maximizing profit through widespread campaigns rather than sector-specific attacks. victims include educational institutions, healthcare providers, and corporate entities in various countries, with a preference for easy compromise targets.

Rhysida is a mid-tier ransomware operation that leverages phishing emails to distribute their malware, which requires Cobalt Strike for initial breach execution. Once deployed, the rhysida ransomware encrypts files and appends '.ryshida' extensions. Victims are instructed to contact via a portal for decryption keys. Ransoms are paid in Bitcoin, with the group threatening data leaks if payments aren't made. Since their emergence, they have targeted organizations across multiple sectors including education, healthcare, and local government.

Key Capabilities

• Phishing via spear-phishing emails
• Cobalt Strike for initial access and lateral movement
• Ransomware deployment with '.ryshida' file extension
• Data exfiltration for ransom leverage
• Bitcoin-based payment mechanism

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Rhysida has carried out numerous campaigns across North America and Europe, targeting sectors like education and healthcare. Their recent operations include attacks against Stelia North America and Southold Town Senior Services, indicating a preference for critical infrastructure and organizations with less robust defenses.

IOC Patterns

• Malicious hashes identified from MD5 samples
• Network communication patterns indicative of Cobalt Strike activity
• Spear-phishing emails with malicious attachments

Recommended Actions

• Implement advanced email filtering solutions to detect phishing attempts.
• Monitor for Cobalt Strike-related network behaviors and signatures.
• Enhance endpoint detection to identify and block rhysida payloads.
• Establish routine backups and isolate critical systems from direct internet access.
• Educate users on recognizing malicious emails and avoiding suspicious links.

Suggested Tags