What is Rhysida ransomware?

Rhysida is a ransomware-as-a-service group that appeared in May 2023. CISA, the FBI and the MS-ISAC described it in joint advisory AA23-319A of 15 November 2023, noting that it attacked opportunistically across education, health care, manufacturing, IT and government, using double extortion. According to the advisory, its actors got in mostly through external remote services such as VPNs, often with stolen credentials where multi-factor authentication was not enforced, through phishing, and in some cases by exploiting the Zerologon vulnerability in domain controllers. Once inside, they used built-in admin tools and remote desktop to move around, the living-off-the-land pattern seen in many groups. For a small company, the advisory's message is familiar but important: require MFA on every remote access path, patch domain controllers, restrict remote desktop, and segment the network so that a single foothold does not expose everything.

← All 25 questions on Ransomware groups and familiesAll topics