rhysida ransomware group
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF…
- Claims in 7 days
- 3
- Claims in 30 days
- 17
- Reported techniques
- 25
Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.
Where it claims victims
| Country | Claims in 60 days |
|---|---|
| United States | 3 |
| Malaysia | 2 |
| Thailand | 1 |
| Brazil | 1 |
| Switzerland | 1 |
| Mexico | 1 |
| Belgium | 1 |
| Germany | 1 |
Sectors
| Sector | Claims in 60 days |
|---|---|
| Manufacturing | 4 |
| Financial Services | 4 |
| Professional Services | 3 |
| Education | 2 |
| Government & Defense | 1 |
| Energy & Utilities | 1 |
Reported techniques
Abuse Elevation Control MechanismPhishingCommand and Scripting InterpreterShared ModulesBoot or Logon Autostart ExecutionProcess InjectionObfuscated Files or InformationMasqueradingVirtualization/Sandbox EvasionHide ArtifactsReflective Code LoadingApplication Window DiscoveryProcess DiscoverySystem Information DiscoveryFile and Directory DiscoverySoftware DiscoveryData from Local SystemAutomated CollectionExfiltration Over C2 ChannelApplication Layer ProtocolData Encrypted for ImpactAcquire InfrastructureDevelop CapabilitiesActive ScanningPhishing for Information