Rhysida

Leverages spear-phishing campaigns (T1566.001/T1566.002) with malicious attachments, often utilizing Gootloader malware for initial foothold. Exploits VPN vulnerabilities (T1133) particularly targeting services without MFA implementation. Compromises exposed RDP services (T1021.001) through credential stuffing and brute force attacks. Recent campaigns incorporate search engine optimization poisoning through typo-squatted domains.

Conducts extensive network reconnaissance using built-in Windows utilities and PowerShell scripts (T1057). Enumerates domain controllers, file servers, and backup systems to identify critical assets. Maps network topology and identifies security tool deployments for evasion planning. Utilizes Active Directory queries to understand organizational structure and privileged accounts.

Deploys Cobalt Strike beacons (S0154) for persistent command and control infrastructure. Establishes RDP sessions for manual operations and data staging. Implements PortStarter backdoor (main.dll) for redundant access channels. Maintains multiple access vectors to ensure operational continuity during remediation attempts.

Clears event logs using wevtutil (T1070.001) to remove forensic artifacts. Employs PowerShell obfuscation techniques to bypass security controls. Masquerades processes as legitimate Windows services (T1036). Disables security software through BYOVD (Bring Your Own Vulnerable Driver) attacks when administrative access achieved.

Harvests credentials using Mimikatz and similar tools (T1003). Targets LSASS memory dumps for password extraction. Exploits stored credentials in browsers and credential managers. Leverages compromised service accounts for elevated privileges and lateral movement.

Establishes multi-tiered C2 infrastructure using TOR and compromised legitimate sites. Implements Cobalt Strike with custom profiles to evade detection. Utilizes encrypted channels over standard ports (443/HTTPS) to blend with normal traffic. Maintains redundant C2 nodes across multiple geographic regions for resilience.

Leverages PsExec (S0029) for remote execution across domain systems. Utilizes RDP for manual movement between compromised hosts. Exploits Windows Management Instrumentation (WMI) (T1047) for stealthy execution. Targets domain controllers and file servers to maximize encryption impact.

Stages data in C:\out directories before exfiltration to cloud storage. Utilizes Azure Storage Explorer and AZCopy for bulk data transfers (T1567.002). Compresses sensitive files using WinRAR before exfiltration. Targets specific file types including databases, financial records, and personally identifiable information.

Creates scheduled tasks (T1053) configured to survive system reboots. Modifies registry keys for autostart functionality. Deploys PowerShell scripts in startup folders for redundant persistence. Establishes multiple persistence mechanisms to maintain access during partial remediation.

Achieves widespread file encryption across enterprise environments within hours. Disrupts critical business operations through systematic targeting of essential systems. Creates significant recovery challenges through VSS deletion and backup targeting. Compounds damage through data theft and publication threats in double extortion model.

Deploys "Rhysida-0.1" ransomware binary through PowerShell or manual execution. Implements intermittent encryption of 1 MiB chunks for speed optimization. Appends .rhysida extension to encrypted files. Targets both local drives and mapped network shares for maximum impact.

Deploys "CriticalBreachDetected.pdf" ransom notes across encrypted systems. Directs victims to TOR-based payment portals with unique identifiers. Threatens data publication on dedicated leak sites if demands not met within specified timeframes. Demands range from hundreds of thousands to millions in Bitcoin payments.

Deletes Volume Shadow Copies (VSS) to prevent file recovery (T1490). Disables Windows recovery options and system restore points. Removes ransomware binaries and staging directories after encryption completion. Clears additional logs and forensic artifacts to complicate incident response.