Ransomware Intelligence / Groups / rhysida
Ransomware group
rhysida
Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the
- 6claims, 7 days
- 21claims, 30 days
- 44claims, 90 days
- 2026-04-27first seen
- 2026-11-04last seen
These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.
Activity, last 26 weeks
New leak-site claims per week.
In the news
Recent stories in the security press that name rhysida, newest first.
Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked
Sectors claimed, last 90 days
Countries claimed, last 90 days
- United States 21
- Germany 7
- Unknown 2
- Malaysia 2
- Australia 1
- Belgium 1
- Canada 1
- Colombia 1
- France 1
- HU 1
- Italy 1
- LB 1
- Mexico 1
- Philippines 1
- Sweden 1
Vulnerabilities rhysida exploits
CVEs attributed to rhysida by Ransomware.live, most severe first. Patch these first if this group is in your threat model.
| CVE | Vendor / product | CVSS | CISA KEV |
|---|---|---|---|
| CVE-2026-50751 | Check Point Security Gateway | 9.3 Critical | Listed 2026-06-08, ransomware use |
| CVE-2026-48027 | Nx Nx Console | 9.3 Critical | Listed 2026-05-27, ransomware use |
| CVE-2023-21529 | Microsoft Exchange Server | 8.8 High | Listed 2026-04-13, ransomware use |
| CVE-2024-1708 | ConnectWise ScreenConnect | 8.4 High | Listed 2026-04-28, ransomware use |
| CVE-2025-60710 | Microsoft Windows | 7.8 High | Listed 2026-04-13, ransomware use |
70% of successful ransomware attacks use remote encryption (Microsoft, 2024): files on protected servers are encrypted over the network from a device the attacker controls. Read our remote encryption briefing →
Newest vulnerabilities used by any ransomware group (CISA KEV)
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Tactics and techniques
MITRE ATT&CK techniques reported for rhysida by Ransomware.live, in attack order.
- Reconnaissance
- Resource Development
- Initial Access
- Execution
- Persistence
- Privilege Escalation
- Defense Evasion
- Discovery
- Collection
- Command and Control
- Exfiltration
- Impact
Track rhysida in the weekly brief
One email a week: which groups are active in your sector, what they are exploiting, and what to patch. Drafted from the data on this site and read by a human before it goes out. No sales follow-up.
Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 14 hours ago
Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology