MS-ISAC joint advisory

April 30, 2025: The advisory was updated to reflect new IOCs employed by Rhysida associates, as well as remove outdated IOCs and TTPs for effective threat hunting.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi- State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Rhysida ransomware IOCs and TTPs identified through investigations as recently as December 2024. Rhysida has predominately been deployed against the education, healthcare, manufacturing, information technology, and government sectors since May 2023. The information in this advisory is derived from related incident response investigations and malware analysis of samples discovered on victim networks.

FBI, CISA, and the MS-ISAC encourage organizations to implement best practices to defend against ransomware and the Rhysida-specific recommendations in the Mitigations section of this advisory.

Organizations should take the following actions today to mitigate malicious cyber activity:

Prioritize remediating known exploited vulnerabilities.

Enable multifactor authentication (MFA) for all services to the extent possible, particularly for webmail, VPN, and accounts that access critical systems.

Segment networks to prevent the spread of ransomware.

Download the PDF version of this report:

For a downloadable copy of updated IOCs, see:

For a downloadable copy of historic IOCs, see:

Note: This advisory uses the MITRE ATT&CK ® Matrix for Enterprise , version 17. See the MITRE ATT&CK Tactics and Techniques section for tables mapped to the threat actors’ activity.

Threat actors leveraging Rhysida ransomware are known to impact “targets of opportunity,” including victims in the education, healthcare, manufacturing, information technology, and government sectors. Open source reporting details similarities between Vice Society (DEV-0832)[ 1 ] activity and the actors observed deploying Rhysida ransomware. Additionally, open source reporting[ 2 ] has confirmed observed instances of Rhysida actors operating in a ransomware-as-a-service (RaaS) capacity, where ransomware tools and infrastructure are leased out in a profit-sharing model. Any ransoms paid are then split between the group and the associates.

For additional information on Vice Society actors and associated activity, see the joint advisory #StopRansomware: Vice Society .

Rhysida actors have been observed leveraging external-facing remote services to initially access and persist within a network. Remote services, such as virtual private networks (VPNs), allow users to connect to internal enterprise network resources from external locations. Rhysida actors have commonly been observed authenticating to internal VPN access points with compromised valid credentials [ T1078 ] , notably due to organizations lacking MFA enabled by default.

Update April 30, 2025

Rhysida actors have also used Gootloader malware at times for initial access [ TA0001 ].

Analysis identified Rhysida actors using living off the land techniques, such as creating Remote Desktop Protocol (RDP) connections for lateral movement [ T1021.001 ] , establishing VPN access, and utilizing PowerShell [ T1059.001 ] . Living off the land techniques include using native (built into the operating system) network administration tools to perform operations. This allows the actors to evade detection by blending in with normal Windows systems and network activities.

Ipconfig [ T1016 ] , whoami [ T1033 ] , nltest [ T1482 ] , and several net commands have been used to enumerate victim environments and gather information domains. In one instance of using compromised credentials, actors leveraged net commands within PowerShell to identify logged-in users and perform reconnaissance on network accounts within the victim environment. Note: The following commands were not performed in the exact order listed.

net user [username] /domain [ T1087.002 ]

net group “domain computers” /domain [ T1018 ]

net group “domain admins” /domain [ T1069.002 ]

net localgroup administrators [ T1069.001 ]

Analysis of the master file table (MFT)[ 3 ] identified the victim system generated the ntuser.dat registry hive, which was created when the compromised user logged in to the system for the first time. This was considered anomalous due to the baseline of normal activity for the compromised user and system. Note: The MFT resides within the New Technology File System (NTFS) and houses information a file including its size, time and date stamps, permissions, and data content.

Table 1 lists legitimate tools Rhysida actors have repurposed for their operations. The legitimate tools listed in this joint advisory are all publicly available. Use of these tools should not be attributed as malicious without analytical evidence to support they are used at the direction of or controlled by threat actors.

Update April 30, 2025:

Recent techniques include leveraging AZCopy [ T1059.009 ], a command-line utility that users leverage to copy blobs or files to, from, or between Azure storage accounts [ T1530 ] and StorageExplorer-windows-x64.exe , a standalone application that allows users to manage and interact with their cloud storage.

Disclaimer: Organizations are encouraged to investigate and vet use of these tools prior to performing remediation actions.

A standard Windows tool used to interact with the NTDS database. Rhysida actors used this tool to extract and dump the NTDS.dit database from the domain controller containing hashes for all Active Directory (AD) users.

Note: It is strongly recommended that organizations conduct domain wide password resets and double Kerberos TGT password resets if any indication is found that the NTDS.dit file was compromised.

Rhysida Ransomware Characteristics

In one investigation, Rhysida actors created two folders in the C:\ drive labeled in and out , which served as a staging directory (central location) for hosting malicious executables. The in folder contained file names in accordance with host names on the victim’s network, likely imported through a scanning tool. The out folder contained various files listed in Table 2 below. Rhysida actors deployed these tools and scripts to assist system and network-wide encryption.

Rhysida ransomware uses a Windows 64-bit Portable Executable (PE) or common object file format (COFF) compiled using MinGW via the GNU Compiler Collection (GCC), which supports various programming languages such as C, C++, and Go. The cryptographic ransomware application first injects the PE into running processes on the compromised system [ T1055.002 ]. Additionally, third party researchers identified evidence of Rhysida actors developing custom tools with program names set to “Rhysida-0.1” [ T1587 ].

After mapping the network, the ransomware encrypts data using a 4096-bit RSA encryption key with a ChaCha20 algorithm [ T1486 ]. The algorithm features a 256-bit key, a 32-bit counter, and a 96-bit nonce along with a four-by-four matrix of 32-bit words in plain text. Registry modification commands [ T1112 ] are not obfuscated, displayed as plain-text strings and executed via cmd.exe .

Rhysida’ s encryptor runs a file to encrypt and modify all targeted files to display a .rhysida extension.[ 4 ] Following encryption, a PowerShell command deletes the binary [ T1070.004 ] from the network using a hidden command window [ T1564.003 ]. The Rhysida encryptor allows arguments -d (select a directory) and -sr (file deletion), defined by the authors of the code as parseOptions.[ 5 ] After the lines of binary strings complete their tasks, they delete themselves through the control panel to evade detection.

Rhysida actors reportedly engage in “double extortion” [ T1657 ]—demanding a ransom payment to decrypt victim data and threatening to publish the sensitive exfiltrated data unless the ransom is paid.[ 4 ],[ 6 ] Rhysida actors direct victims to send ransom payments in Bitcoin to cryptocurrency wallet addresses provided by the threat actors. As shown in Figure 1 , Rhysida ransomware drops a ransom note named “CriticalBreachDetected” as a PDF file—the note provides each company with a unique code and instructions to the group via a Tor-based portal.

Identified in analysis and listed in open-source reporting, the contents of the ransom note are embedded as plain-text in the ransom binary, offering network defenders an opportunity to deploy string-based detection for alerting on evidence of the ransom note. Rhysida threat actors may target systems that do not use command-line operating systems. The format of the PDF ransom notes could indicate that Rhysida actors only target systems that are compatible with handling PDF documents.[ 7 ]

Indicators of Compromise

On November 10, 2023, Sophos published TTPs and IOCs identified from analysis of six separate incidents among others indicators that are listed on GitHub.[ 8 ],[ 9 ] Additional IOCs were obtained from FBI, CISA, and the MS-ISAC’s investigations and analysis.

Update April 30, 2025:

Many indicators provided in this advisory’s initial publication are now removed because they are outdated. For historic reference see AA23-319A #StopRansomware: Rhysida Ransomware .

The email addresses listed in Table 4 are associated with Rhysida actors’ operations. Rhysida actors have been observed creating Onion Mail email accounts for services or victim communication, commonly in the format: [First Name][Last Name]@onionmail[.]org .

Rhysida actors have been observed using the following URLs and URIs listed in Table 5 to support their operations.

Update April 30, 2025:

Rhysida actors have also been observed using the following file paths listed in Table 6 to support their operations.

Disclaimer: Organizations are encouraged to investigate the use of the files in Table 7 for related signs of compromise prior to performing remediation actions.

MITRE ATT&CK Tactics and Techniques

See Table 9 to Table 19 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool .

Additional notable TTPs have been published by the Check Point Incident Response Team.[ 10 ]

Update April 30, 2025:

FBI, CISA, and the MS-ISAC recommend that organizations implement the mitigations below to improve your organization’s cybersecurity posture. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, and TTPs. Visit CISA’s Cross-Sector Cybersecurity Performance Goals for more information on the CPGs, including additional recommended baseline protections.

These mitigations apply to all critical infrastructure organizations and network defenders. FBI, CISA, and the MS-ISAC recommend incorporating secure-by-design and -default principles, limiting the impact of ransomware techniques and strengthening overall security posture. For more information on secure by design, see CISA’s Secure by Design webpage.

Require phishing-resistant MFA for all services to the extent possible, particularly for webmail, VPN, and accounts that access critical systems [ CPG 2.H ].

Disable command-line and scripting activities and permissions. Privilege escalation and lateral movement often depend on software utilities running from the command line. If threat actors are not able to run these tools, they will have difficulty escalating privileges and/or moving laterally [ CPG 2.N ].

Implement robust and enhanced logging within processes such as command line auditing[ 11 ] and process tracking[ 12 ].

Restrict the use of PowerShell using Group Policy and only grant access to specific users on a case-by-case basis. Typically, only those users or administrators who manage the network or Windows operating systems should be permitted to use PowerShell [ CPG 2.E ].

Update Windows PowerShell or PowerShell Core to the latest version and uninstall all earlier PowerShell versions. Logs from Windows PowerShell prior to version 5.0 are either non-existent or do not record enough detail to aid in enterprise monitoring and incident response activities [ CPG 1.E , 2.S , 2.T ].

Enable enhanced PowerShell logging [ CPG 2.T , 2.U ]. PowerShell logs contain valuable data, including historical operating system and registry interaction and possible TTPs of a threat actor’s PowerShell use. Ensure PowerShell instances (using the latest version) have module, script block, and transcription logging enabled (e.g., enhanced logging). The two logs that record PowerShell activity are the PowerShell Windows event log and the PowerShell operational log. FBI, CISA, and the MS-ISAC recommend turning on these two Windows event logs with a retention period of at least 180 days. These logs should be checked on a regular basis to confirm whether the log data has been deleted or logging has been turned off. Set the storage size permitted for both logs to as large as possible.

PowerShell logs contain valuable data, including historical operating system and registry interaction and possible TTPs of a threat actor’s PowerShell use.

Ensure PowerShell instances (using the latest version) have module, script block, and transcription logging enabled (e.g., enhanced logging).

The two logs that record PowerShell activity are the PowerShell Windows event log and the PowerShell operational log. FBI, CISA, and the MS-ISAC recommend turning on these two Windows event logs with a retention period of at least 180 days. These logs should be checked on a regular basis to confirm whether the log data has been deleted or logging has been turned off. Set the storage size permitted for both logs to as large as possible.

Restrict the use of RDP and other remote desktop services to known user accounts and groups. If RDP is necessary, apply best practices such as [ CPG 2.W ] : Implementing MFA for privileged accounts using RDP. Using Remote Credential Guard[ 13 ] to protect credentials, particularly domain administrator or other high value accounts. Auditing the network for systems using RDP. Closing unused RDP ports. Enforcing account lockouts after a specified number of attempts. Logging RDP login attempts.

Implementing MFA for privileged accounts using RDP.

Using Remote Credential Guard[ 13 ] to protect credentials, particularly domain administrator or other high value accounts.

Auditing the network for systems using RDP.

Closing unused RDP ports.

Enforcing account lockouts after a specified number of attempts.

Logging RDP login attempts.

Secure remote access tools by: Implementing application controls to manage and control execution of software, including allowlisting remote access programs. Application controls should prevent the installation and execution of portable versions of unauthorized remote access and other software. A properly configured application allowlisting solution will block any unlisted application execution. Allowlisting is important as antivirus solutions may fail to detect the execution of malicious portable executables when the files use any combination of compression, encryption, or obfuscation. Apply the recommendations in CISA's joint Guide to Securing Remote Access Software .

Implementing application controls to manage and control execution of software, including allowlisting remote access programs. Application controls should prevent the installation and execution of portable versions of unauthorized remote access and other software. A properly configured application allowlisting solution will block any unlisted application execution. Allowlisting is important as antivirus solutions may fail to detect the execution of malicious portable executables when the files use any combination of compression, encryption, or obfuscation.

Apply the recommendations in CISA's joint Guide to Securing Remote Access Software .

In addition, FBI, CISA, and the MS-ISAC recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, and to reduce the impact and risk of compromise by ransomware or data extortion actors:

Keep all operating systems, software, and firmware up to date. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. Prioritize patching known exploited vulnerabilities in internet-facing systems [ CPG 1.E ].

Segment networks to prevent the spread of ransomware. Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to— various subnetworks and by restricting adversary lateral movement [ CPG 2.F ].

Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a network monitoring tool. To aid in detecting ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host [ CPG 3.A ].

Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege (PoLP) [ CPG 2.E ].

Implement time-based access for accounts set at the admin level and higher [ CPG 2.A , 2.E ]. For example, the just-in-time (JIT) access method provisions privileged access when needed and can support the enforcement of PoLP (as well as the zero trust model). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the active directory level or domain service functional level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.

Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drive, storage device, or the cloud).

Maintain offline backups of data and regularly maintain backups and their restoration (daily or weekly at minimum). By instituting this practice, organizations limit the severity of disruption to business operations [ CPG 2.R ].

Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [ CPG 2.K , 2.L , 2.R ].

Forward log files to a hardened centralized logging server, preferably on a segmented network [ CPG 2.F ]. Review logging retention rates, such as for VPNs and network-based logs.

Consider adding an email banner to emails received from outside your organization [ CPG 2.M ].

Disable hyperlinks in received emails.

Validate Security Controls

In addition to applying mitigations, FBI, CISA, and the MS-ISAC recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. FBI, CISA, and the MS-ISAC recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

Select an ATT&CK technique described in this advisory (see Table 9 to Table 19 ).

Align your security technologies against the technique.

Test your technologies against the technique.

Analyze your detection and prevention technologies’ performance.

Repeat the process for all security technologies to obtain a set of comprehensive performance data.

Refine your security program, including people, processes, and technologies, based on the data generated by this process.

FBI, CISA, and the MS-ISAC recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

CISA: #StopRansomware

CISA: #StopRansomware Vice Society

CISA: Known Exploited Vulnerabilities Catalog

CISA, MITRE: Best Practices for MITRE ATT&CK Mapping

CISA: Cross-Sector Cybersecurity Performance Goals

CISA: Secure by Design

CISA: Implementing Phishing-Resistant MFA

CISA: Guide to Securing Remote Access Software

Microsoft: DEV-0832 (Vice Society) Opportunistic Ransomware Campaigns Impacting US Education Sector

FortiGuard Labs: Ransomware Roundup - Rhysida

Microsoft: Master File Table (Local File Systems)

WatchGuard: Rhysida Ransomware

Cisco Talos: What Cisco Talos Knows the Rhysida Ransomware

SOC Radar: Rhysida Ransomware Threat Profile

Sophos: A Threat Cluster’s Switch from Vice Society to Rhysida

Sophos: Vice Society - Rhysida IOCs (GitHub)

Check Point Research: Rhysida Ransomware - Activity and Ties to Vice Society

Microsoft: Command Line Process Auditing

Microsoft: Audit Process Tracking

Microsoft: Remote Credential Guard

Your organization has no obligation to respond or provide information back to FBI in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to FBI, reporting must be consistent with applicable state and federal laws.

FBI is interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with Rhysida actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.

Additional details of interest include a targeted company point of , status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.

FBI and CISA do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3) , a local FBI Field Office , or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center ( [email protected] ) or by calling 1-844-Say-CISA (1-844-729-2472). State, Local, Tribal, and Territorial government entities are encouraged to report ransomware incidents to the MS-ISAC via its 24x7x365 Security Operations Center ( SOC@cisecurity.org ) or by calling (1-866-787-4722).

The information in this report is being provided “as is” for informational purposes only. FBI, CISA, and the MS-ISAC do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI, CISA, and the MS-ISAC.

Sophos contributed to this advisory.

November 15, 2023: Initial version. April 30, 2025: The advisory was updated to reflect new IOCs.

This product is provided subject to this Notification and this Privacy & Use policy.