{"id":453,"count":0,"description":"
\n
\n Year Established<\/span>\n
2023<\/div>\n <\/div>\n
\n Attribution<\/span>\n
Unknown<\/div>\n <\/div>\n
\n Motivation<\/span>\n
Financial<\/div>\n <\/div>\n
\n Modus Operandi (MO)<\/span>\n
Double-extortion ransomware, healthcare targeting, VPN exploitation, auctioning victim data<\/div>\n <\/div>\n
\n Primary Aliases<\/span>\n
Rhysida Ransomware Group<\/div>\n <\/div>\n<\/div>\n

Rhysida is a ransomware group that emerged in mid-2023 and rapidly attracted attention for high-profile attacks against healthcare providers and government entities, as well as for an unconventional data monetisation approach that distinguishes them from typical ransomware operators. The group conducts double-extortion operations combining file encryption with data theft, but uniquely has experimented with auctioning stolen victim data to the highest bidder rather than simply threatening publication , creating a competitive bidding dynamic among potential buyers of sensitive information.<\/p>\n

Rhysida gained significant media attention through their attack on Insomniac Games (a PlayStation studio), from which they exfiltrated and published approximately 1.67 terabytes of internal data including unreleased game content, employee personal data, and internal business documents after the studio declined to pay ransom. The attack demonstrated Rhysida's willingness to follow through on data publication threats against cultural sector targets as effectively as against more traditional corporate victims.<\/p>\n

Healthcare organisations have been disproportionately targeted by Rhysida, including multiple hospital systems in the United States and internationally , attacks that CISA specifically warned about in a November 2023 advisory alongside the FBI. Their healthcare targeting prompted particular government concern given the direct patient safety implications of hospital system disruptions and the sensitivity of medical records as leverage for extortion.<\/p>\n

Rhysida's ransomware is built using the LibTomCrypt library and targets Windows environments, with researchers noting several technical similarities suggesting potential connections to the Vice Society ransomware group. The group recruits affiliates through underground forums and provides a negotiation platform and data leak infrastructure, operating with the organisational structure of an established RaaS operation despite their relatively recent emergence.<\/p>\n\n

Threat Mitigation and Strategic Hardening:<\/strong> Network defense against campaigns linked to Rhysida<\/strong> requires continuous threat surface management, dark web monitoring for stolen employee credentials, and automated telemetry correlation. Organizations should reference our Cyber Risk Checker<\/a> and report critical indicators via Secure Drop<\/a>.<\/p>","link":"https:\/\/cyberasia.io\/actor\/rhysida\/","name":"Rhysida","slug":"rhysida","taxonomy":"threat_actor","parent":0,"meta":[],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors\/453","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/taxonomies\/threat_actor"}],"wp:post_type":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts?threat_actors=453"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}