rhysida

Rhysida is a ransomware group that operates an extortion-focused model, pairing data theft and encryption with pressure tactics such as threatening disclosure or sale of stolen data. ThreatCluster has recorded about 200 victims attributed to Rhysida, with the group targeting Healthcare, Education, Business Services, Government, and Manufacturing sectors, and victims reported in the United States, Canada, the United Kingdom, Australia, and Switzerland. Recent reporting shows Rhysida operates within a shared malware ecosystem—interconnected with Interlock—utilizing initial access brokers and a mix of downloaders and crypters, and employing tools such as the Supper backdoor. For example, on 2026-08-28 Rhysida announced it would auction 5.79 terabytes of data stolen from Berlin state agencies after officials refused to pay a ransom.

Sectors: Healthcare, Education, Business Services · Countries: US, CA, DE