Rhysida

Rhysida, a threat actor active since May 2023, is responsible for a series of ransomware attacks, with a significant focus on the healthcare sector. It accounts for 8% of total cyberattacks, with 38% of its attacks targeting healthcare institutions. The group's modus operandi includes transferring Rhysida ransomware over HTTP/S and emailing it as a compressed attachment, both for infiltration and lateral movement. A notable case involved the breach of Bayhealth Hospital in Delaware, which was later confirmed by the group on their Tor leak site. This isn't the first time Rhysida targeted a hospital, highlighting their persistent threat to the healthcare industry. In December 2023, a joint Cybersecurity Advisory (CSA) was published by the FBI and CISA to warn about Rhysida's ransomware attacks. Despite these efforts, the group continued its malicious activities into 2024. On August 8, 2024, after unsuccessful attempts to monetize their illicit activities, Rhysida published approximately half of the stolen data they claimed to have, comprising 260,000 files (3.1 TB). This publication of data reflects the group's aggressive tactics when initial plans do not yield expected results. The Rhysida group also attempted to auction the stolen data, starting the bid at around $1.7 million in bitcoin. This tactic indicates the group's determination to monetize the breached information, further emphasizing their threat level. Additionally, Rhysida maintains a leak site where they post information about recent victims unwilling to pay ransoms, further exemplifying their intimidation tactics. As such, the Rhysida group represents a significant and ongoing cybersecurity threat, particularly to the healthcare sector.