At a glance
Facts
- Rhysida is a ransomware gang that has been active since mid-2023
rhysida
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.<br> <br> The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.<br> <br> The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.<br> <br> After encryption, the ransomware appends the extension '.ryshida' to encrypted files.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs
Threat intelligence assessment
Activity timeline
Facts
- Targets healthcare organizations, state governments, education institutes, and critical infrastructure
- Claims to have exfiltrated 5.79 TB of data comprising approximately 1.44 million files from Berlin
- Exfiltrated government, legal, financial, contractual, HR, infrastructure, health, and mapping records
- Exfiltrated thousands of names, email addresses, phone numbers, and 148 IBANs
- Exfiltrated plaintext credentials, database accounts, payment-system data, password vaults, and credentials belonging to senior officials
- Exfiltrated personnel files, payroll information, administrative-offense records, email archives, SQL database dumps, identity documents, and banking information
- Exfiltrated documents related to disciplinary proceedings and named cases
- Claimed to exfiltrate alleged classified or sensitive government material including Bundesrat committee records
- Exfiltrated critical-infrastructure security assessments concerning Berlin's water supply
- Exfiltrated more than 3,200 documents marked as nondisclosure agreements
Attribution assessment
Facts
- Rhysida has been active since mid-2023
Initial access and identity targets
Facts
- Method of entry in the Berlin attack has not been disclosed
- In a previous campaign disrupted by Microsoft, used malicious Teams installers to breach targets
Capabilities and evasion
Facts
- Uses GDPR violations as leverage to increase pressure on victims
Observed targeting
Facts
- Likely exfiltrated data from the Senate Department for Mobility, Transport, Climate Protection and the Environment between August 7 and 12
Named victims
Organizations
- Berlin city administration
Reported detail
Facts
- Rhysida ransomware gang attacked Berlin's city administration in mid-August 2026, exfiltrating 5.79 TB of data including government records, credentials, and infrastructure assessments
- The group claims to have stolen approximately 1.44 million files and listed Berlin on their data leak site on August 28
- Berlin's mayor stated the city will not pay the extortion demand, with authorities investigating the incident
- Rhysida has targeted healthcare, government, education, and critical infrastructure since mid-2023
- The attackers threatened to publish stolen files within four days unless paid, citing GDPR violations as pressure
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
First listed
Victim claimMISC Group listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedLast observed
Indicator2 indicators cataloged
Types: onion.
First listed
Victim claimLine2Line Coatings listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimSanders Law Group listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimDR.SCHNELL GmbH & Co. KGaA listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimCharles E. Tabor AAL LLC listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimReed & Giordano PA listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimGress Clark Young & Schoepper listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimRealManage listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimSkaff Group listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimMat Bao Corporation listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimElectro Heat Sweden AB listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimclicks digital GmbH Information listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimLaw Offices of R. David Williams, P.A. listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimNEAD Pro listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimLegis listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimMPA Pharma listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimAxdia International listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimKreishandwerkerschaft Borken listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimGeneral Santos Doctors Hospital listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimProfessional Retail Services listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimSAD'S Interim listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimRug & Home listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimSzechenyi Programiroda Nonprofit Kf listed by rhysida
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedCataloged
Indicator1 indicator cataloged
Types: tool.
The interactive view includes 102 dated events with category filters and paging.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
rhysidaCanonical Name
Loading CVEs, techniques, indicators, malware, victims, and activity...