Rhysida

Rhysida emerged in May 2023 and operates a RaaS model, deploying against targets of opportunity in education, healthcare, manufacturing, information technology and government. It steals data first and encrypts later, then threatens publication on its leak/'auction' site if the victim does not pay. A joint CISA/FBI/MS-ISAC advisory (AA23-319A) documents its tradecraft, and open-source reporting notes overlaps with Vice Society (DEV-0832) activity.

The operation remained highly active through 2025-2026. CISA updated the Rhysida advisory in April 2025 with fresh indicators and added Gootloader as a confirmed initial-access vector. In October 2025, Microsoft disrupted a Vanilla Tempest campaign that used fake Microsoft Teams installers and the Oyster backdoor to deploy Rhysida, revoking more than 200 fraudulently used code-signing certificates.

Rhysida's leak site has listed victims in Kuwait and the UAE among its international claims. Such listings are the group's own extortion allegations and should be treated as claims, not confirmed breaches, unless independently verified.