# What is Rhysida ransomware?

Rhysida is a ransomware-as-a-service group that appeared in May 2023. CISA, the FBI and the MS-ISAC described it in joint advisory AA23-319A of 15 November 2023, noting that it attacked opportunistically across education, health care, manufacturing, IT and government, using double extortion. According to the advisory, its actors got in mostly through external remote services such as VPNs, often with stolen credentials where multi-factor authentication was not enforced, through phishing, and in some cases by exploiting the Zerologon vulnerability in domain controllers. Once inside, they used built-in admin tools and remote desktop to move around, the living-off-the-land pattern seen in many groups. For a small company, the advisory's message is familiar but important: require MFA on every remote access path, patch domain controllers, restrict remote desktop, and segment the network so that a single foothold does not expose everything.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-rhysida-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is Medusa ransomware?](https://netsenx.com/en/faq/what-is-medusa-ransomware)
- [What is RansomHub ransomware?](https://netsenx.com/en/faq/what-is-ransomhub-ransomware)
- [What is Cl0p ransomware?](https://netsenx.com/en/faq/what-is-cl0p-ransomware)
- [What is BianLian ransomware?](https://netsenx.com/en/faq/what-is-bianlian-ransomware)
- [What was Hive ransomware?](https://netsenx.com/en/faq/what-was-hive-ransomware)