Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
Rhysida is a ransomware-as-a-service operation active since May 2023 that hits targets of opportunity across education, healthcare, manufacturing, IT and government, using double extortion.
Rhysida emerged in May 2023 and operates a RaaS model, deploying against targets of opportunity in education, healthcare, manufacturing, information technology and government. It steals data first and encrypts later, then threatens publication on its leak/'auction' site if the victim does not pay. A joint CISA/FBI/MS-ISAC advisory (AA23-319A) documents its tradecraft, and open-source reporting notes overlaps with Vice Society (DEV-0832) activity.
The operation remained highly active through 2025-2026. CISA updated the Rhysida advisory in April 2025 with fresh indicators and added Gootloader as a confirmed initial-access vector. In October 2025, Microsoft disrupted a Vanilla Tempest campaign that used fake Microsoft Teams installers and the Oyster backdoor to deploy Rhysida, revoking more than 200 fraudulently used code-signing certificates.
Rhysida's leak site has listed victims in Kuwait and the UAE among its international claims. Such listings are the group's own extortion allegations and should be treated as claims, not confirmed breaches, unless independently verified.
+20 more relationships — see the relationships browser.
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.