Rhysida

Rhysida, a threat actor active since May 2023, has been responsible for numerous high-profile ransomware attacks. The group is known for its use of various ransomware families, including BlackCat, Hello Kitty, Quantum Locker, Rhysida, Zeppelin, and its own eponymous program, to aid in double extortion attacks. Notably, the group's ransomware payload has evolved over time, shifting from BlackCat, Quantum Locker, Zeppelin, and a Vice Society-branded variant of the Zeppelin ransomware, to Rhysida, and as of August 2024, INC ransomware. Rhysida has targeted various "opportunities," leading to significant data breaches. For instance, nonprofit healthcare organization Axis Health System was hit by a Rhysida ransomware attack, resulting in the theft of sensitive data, including mental health and substance abuse records. In another notable incident, Port of Seattle confirmed that Rhysida was behind a cyberattack in August 2024, leading to data theft. Rhysida demanded a $3.4 million ransom in this case, which the hospital refused to pay. The group uses multiple methods for infiltration and lateral movement, such as transferring ransomware over HTTP/S and emailing ransomware as a compressed attachment. Rhysida often demands substantial ransoms and threatens to publish stolen data if unpaid. In one instance, the group demanded $1.5 million and threatened to release the data within six days if the payment wasn't made. These aggressive tactics and the group's adaptability underscore the growing threat posed by Rhysida in the cybersecurity landscape.