Search threats, CVEs… ⌘K
← Back to all threat actors

rhysida

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.<br> <br> The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.<br> <br> The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.<br> <br> After encryption, the ransomware appends the extension '.ryshida' to encrypted files.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs

How we source and review actor profiles
Motivation
ransomware
First seen
2026-04-27
Last seen
2026-09-10
Sectors
education, healthcare, professional-services, government-defense, manufacturing, technology, retail-e-commerce, transportation, agriculture-and-food-production, financial-services, other, hospitality
Status
Active

Threat intelligence assessment

At a glance

Facts

  • Rhysida is a ransomware gang that has been active since mid-2023

Activity timeline

Facts

  • Targets healthcare organizations, state governments, education institutes, and critical infrastructure
  • Claims to have exfiltrated 5.79 TB of data comprising approximately 1.44 million files from Berlin
  • Exfiltrated government, legal, financial, contractual, HR, infrastructure, health, and mapping records
  • Exfiltrated thousands of names, email addresses, phone numbers, and 148 IBANs
  • Exfiltrated plaintext credentials, database accounts, payment-system data, password vaults, and credentials belonging to senior officials
  • Exfiltrated personnel files, payroll information, administrative-offense records, email archives, SQL database dumps, identity documents, and banking information
  • Exfiltrated documents related to disciplinary proceedings and named cases
  • Claimed to exfiltrate alleged classified or sensitive government material including Bundesrat committee records
  • Exfiltrated critical-infrastructure security assessments concerning Berlin's water supply
  • Exfiltrated more than 3,200 documents marked as nondisclosure agreements

Attribution assessment

Facts

  • Rhysida has been active since mid-2023

Initial access and identity targets

Facts

  • Method of entry in the Berlin attack has not been disclosed
  • In a previous campaign disrupted by Microsoft, used malicious Teams installers to breach targets

Capabilities and evasion

Facts

  • Uses GDPR violations as leverage to increase pressure on victims

Observed targeting

Facts

  • Likely exfiltrated data from the Senate Department for Mobility, Transport, Climate Protection and the Environment between August 7 and 12

Named victims

Organizations

  • Berlin city administration

Reported detail

Facts

  • Rhysida ransomware gang attacked Berlin's city administration in mid-August 2026, exfiltrating 5.79 TB of data including government records, credentials, and infrastructure assessments
  • The group claims to have stolen approximately 1.44 million files and listed Berlin on their data leak site on August 28
  • Berlin's mayor stated the city will not pay the extortion demand, with authorities investigating the incident
  • Rhysida has targeted healthcare, government, education, and critical infrastructure since mid-2023
  • The attackers threatened to publish stolen files within four days unless paid, citing GDPR violations as pressure

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimGeneral Santos Doctors Hospital listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimProfessional Retail Services listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator2 indicators cataloged

Types: onion.

First listed
Victim claimSAD'S Interim listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimRug & Home listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSzechenyi Programiroda Nonprofit Kf listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Cataloged
Indicator1 indicator cataloged

Types: tool.

First listed
Victim claimValley Health Team listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBerlin, Germany listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimCRI Electric listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimBattle Creek Public Schools listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimFairview Dental Group listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimComing soon listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimPierce Township listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSIA Medical Centre listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimLawson Roofing listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimIDS Group listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimLandeshauptstadt Stuttgart listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTower View Primary School listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimStelia North America listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimSouthold Town Senior ServicesSouthold Police Department listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimRohner listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimLeading Edge Speciali listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimLakeside Union School District listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimElabs listed by rhysida

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 102 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

rhysidaCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...