Rhysida

Rhysida is a globally active threat actor known for its ransomware operations, which have impacted a wide range of sectors, particularly the government and public sector. Their use of CleanUpLoader makes their operations highly effective and difficult to detect, as it not only facilitates persistence but also enables Rhysida actors to exfiltrate valuable data before deploying the ransomware. High-profile breaches include the attack on King Edward VII’s Hospital in London in 2023, where Rhysida claimed to have stolen sensitive information from hospital staff and patients, including members of the British royal family. Additionally, attacks on the Chilean Army and the City of Columbus demonstrate Rhysida's ability to infiltrate critical public sector infrastructures. The group uses various infiltration and lateral movement methods such as transferring ransomware over HTTP/S and emailing ransomware as a compressed attachment. These tactics were identified in SafeBreach's coverage of Rhysida's actions, specifically in reports #9075, #9074, #9077, and #9076. The sophistication of Rhysida’s operations means that defending against this ransomware requires a proactive and intelligence-driven approach. By understanding Rhysida’s tactics, security teams can implement more effective defensive strategies to mitigate the impact of this and other advanced ransomware families. Monitoring Rhysida’s infrastructure, including typosquatting domains and CleanUpLoader C2 servers, has been key in detecting their activities. The Insikt Group found that Rhysida victims could be detected on average 30 days before appearing on public extortion sites, indicating an opportunity for early intervention. Given the significant threat Rhysida poses across industries, it is crucial for organizations to maintain vigilant cybersecurity practices and stay updated on Rhysida's evolving tactics.