Rhysida Ransomware
RaaS double extortion
Source Attribution
- Origin
- MITRE
- Source
- CISA advisory AA23-???
- Verified
- 2026-08-26T16:07:01.550Z
- Confidence
- high
Source: CISA advisory AA23-??? · Verified: 2026-08-26T16:07:01.550Z · Confidence: high
Security Timeline
- discovered Rhysida Ransomware first observed
- updated Encyclopedia entry reviewed (Phase 45C)
Quick Answer
Rhysida is a RaaS active since 2023, using RDP compromise and a public auction leak site. (attributes recorded from CISA advisory AA23-???).
Definition
Rhysida is a RaaS active since 2023, using RDP compromise and a public auction leak site.
Overview
Rhysida is a RaaS active since 2023, using RDP compromise and a public auction leak site.
Behavior
- RDP access
- auction-style leak site
First Seen
2023-05
Target
RaaS double extortion
Malware Intelligence
Family: Rhysida Ransomware
Techniques: T1486, T1219
Targets: RaaS double extortion
Behavior:
- RDP access
- auction-style leak site
References
Have a follow-up question?
Ask AI about this Start an investigation Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.