rhysidaMalware
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.From MISP Galaxy
Last reported yesterday, by ransomware.live15 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1552.004Private Keys
“…5M credit-line agreement.CEO's personal dossier: valid passport, ID card, tax ID, 11 years of signed tax returns.Access material: TLS private keys for *.dr-schnell.de, ~120 Elster tax certificates, O365 admin password, password lists.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
15 reports, newest first · the exact sentence from each-
rhysida lists Sanders Law Group“rhysida lists Sanders Law Group”
-
rhysida lists Line2Line Coatings“rhysida lists Line2Line Coatings”
-
rhysida lists DR.SCHNELL GmbH & Co. KGaA“rhysida lists DR.SCHNELL GmbH & Co.”
-
rhysida lists Reed & Giordano PA“rhysida lists Reed & Giordano PA”
-
rhysida lists Charles E. Tabor AAL LLC“rhysida lists Charles E.”
-
rhysida lists Gress Clark Young & Schoepper“rhysida lists Gress Clark Young & Schoepper”
-
rhysida lists Anne Arundel County“rhysida lists Anne Arundel County”
-
rhysida lists RealManage“rhysida lists RealManage”
-
rhysida lists Skaff Group“rhysida lists Skaff Group”
-
rhysida lists Mat Bao Corporation“rhysida lists Mat Bao Corporation”
-
rhysida lists Electro Heat Sweden AB“rhysida lists Electro Heat Sweden AB”
-
rhysida lists clicks digital GmbH Information“rhysida lists clicks digital GmbH Information”
-
rhysida lists Law Offices of R. David Williams, P.A.“rhysida lists Law Offices of R.”
-
rhysida lists NEAD Pro“rhysida lists NEAD Pro”
-
rhysida lists Legis“rhysida lists Legis”
Indicators in its reports
named in the reports above- file[.]hospitalin 1 report
- victims[.]taxin 1 report
- agreement[.]ceoin 1 report
- dr-schnell[.]dein 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.