rhysida

Profile

Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.<br> <br> The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.<br> <br> The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.<br> <br> After encryption, the ransomware appends the extension '.ryshida' to encrypted files.<BR>Source: https://github.com/crocodyli/ThreatActors-TTPs

Tactics and techniques (MITRE ATT&CK)

Initial Access

T1548.002 · Abusing Elevation Control Mechanism: Bypass User Account ControlT1566 · Phishing

Execution

T1059 · Command and Scripting InterpreterT1129 · Shared Modules

Persistence

T1547.001 · Registry Run Keys / Startup Folder

Privilege Escalation

T1055 · Process InjectionT1055.003 · Thread Execution HijackingT1547.001 · Registry Run Keys

Defense Evasion

T1027 · Obfuscated Files or InformationT1036 · MasqueradingT1055 · Process InjectionT1055.003 · Thread Execution HijackingT1497 · Virtualization/Sandbox EvasionT1564 · Hidden ArtifactsT1564.004 · NTFS File AttributesT1620 · Reflective DLL Injection

Discovery

T1010 · Application Window DiscoveryT1057 · Process DiscoveryT1082 · System Information DiscoveryT1083 · File and Directory DiscoveryT1497 · Virtualization/Sandbox EvasionT1518.001 · Security Software Discovery

Collection

T1005 · Data from Local SystemT1119 · Automated Collection

Exfiltration

T1041 · Exfiltration Over C2 Channel

Command and Control

T1071 · Application Layer ProtocolT1071.001 · Web Protocols

Impact

T1486 · Data Encrypted for Impact

Resource Development

T1583 · Acquire InfrastructureT1587 · Develop Capabilities

Reconnaissance

T1595 · Active ScanningT1598 · Phishing for Information