Rhysida’s Double Threat: Data Theft, Then Digital Lockdown

Active since: 2023 (major surge in the U.S. throughout December 2025)
Severity: High
Ransomware model: Double extortion (data theft + encryption)
Recent targets: Healthcare, finance, manufacturing, government
Status: Actively attacking U.S. organizations (confirmed new victims December 13, 2025 and ongoing)

What Rhysida Is ?

Rhysida is a ransomware group that doesn’t just lock your files — they steal your data first, then encrypt your systems and threaten to publish or sell that data if you don’t pay.

They try to look “professional” about it. On their leak site, they even pretend to be a cybersecurity service, claiming they “identify weaknesses” in victims. In reality, it’s extortion with a coat of paint.

Since late 2023, they’ve steadily grown more aggressive. In December 2025, they launched a noticeable wave of attacks across the United States, hitting hospitals, clinics, financial firms, factories, and public-sector organizations.

How Rhysida Gets In

Most Rhysida attacks start the same way: someone clicks something they shouldn’t.

Common entry points

Phishing emails with malicious links or attachments
Fake software download sites (Teams, Zoom, PuTTY, AnyDesk)
SEO poisoning and malvertising
Exposed RDP or VPN services with weak credentials
Previously compromised credentials reused across systems

In 2025, they’ve leaned heavily on fake “Microsoft Teams” or “Zoom” installers, sometimes even signed with stolen or abused Microsoft certificates to look legitimate.

What Happens After the Initial Breach

Once inside, Rhysida follows a very deliberate playbook.

1. Establish control

They deploy Cobalt Strike beacons or similar backdoors to maintain access and move quietly through the network.

2. Disable defenses

They use PowerShell scripts (often named things like g.ps1 or variants of SILENTKILL) to:

Stop antivirus and EDR services
Kill backup, database, and email processes
Delete Volume Shadow Copies using vssadmin
Weaken or enable RDP for later access
Change Active Directory passwords to lock defenders out

3. Move laterally

Using tools like PsExec, they spread to servers, file shares, and domain controllers.

4. Steal data (quietly)

Before encrypting anything, they spend days or weeks exfiltrating data using loaders like:

CleanUpLoader
OysterLoader / Latrodectus
SystemBC (for proxying traffic)

5. Encrypt everything

Finally, they deploy the ransomware:

Uses AES/ChaCha for file encryption
Uses RSA-4096 to protect the encryption keys
Appends .rhysida to files
Drops a ransom note called CriticalBreachDetected.pdf

At this point, operations stop — and the extortion begins.

Why the Damage Is So Severe

Encryption alone is bad. Data theft makes it worse.

Rhysida steals:

Patient medical records
Financial documents
HR data
Manufacturing designs
Government and legal files

If victims refuse to pay, Rhysida:

Publishes sample data on their leak site
Auctions stolen data to other criminals
Uses the breach to damage reputation and trust

In several 2025 U.S. cases, terabytes of data were stolen before encryption even started.

Expanded Indicators of Compromise (IOCs)

File-based indicators

Ransom note: CriticalBreachDetected.pdf
Encrypted extension: .rhysida
Suspicious scripts:
- %TEMP%\g.ps1
- %APPDATA%\*.ps1
- PowerShell scripts invoking vssadmin delete shadows
Unexpected executables in:
- C:\Users\Public\
- C:\ProgramData\
- C:\Windows\Temp\

Process and behavior indicators

powershell.exe launched with -ExecutionPolicy Bypass
cmd.exe /c vssadmin delete shadows /all /quiet
Sudden termination of processes:
- sql.exe, mysql.exe, oracle.exe
- veeam.exe, backup.exe
PsExec usage across multiple hosts
AnyDesk installed or launched unexpectedly

Network indicators (patterns, not static IPs)

Because Rhysida rotates infrastructure often, behavior matters more than single IPs:

Encrypted outbound traffic to unfamiliar VPS providers
Long-lived HTTPS connections from servers that normally don’t browse the web
Beacon-like traffic intervals (Cobalt Strike patterns)
Connections shortly after fake installer execution

Known malicious domains often resemble:

microsofft-teams[.]com
putty-down[.]load
Look-alike cloud download pages

Example YARA Rules

These are generic defensive rules meant for internal detection. They should be tested before production use.

YARA – Rhysida Ransom Note

rule Ransomware_Rhysida_Note
{
    meta:
        description = "Detects Rhysida ransom note PDF"
        author = "Internal SOC"
    strings:
        $s1 = "CriticalBreachDetected" ascii
        $s2 = "Your data has been exfiltrated" ascii
        $s3 = "Rhysida" ascii
    condition:
        filesize < 2MB and all of them
}

YARA – Rhysida Encryption Activity

rule Ransomware_Rhysida_Encryption
{
    meta:
        description = "Detects Rhysida-style encryption artifacts"
    strings:
        $ext = ".rhysida" ascii
        $rsa = "RSA-4096" ascii
        $cha = "ChaCha" ascii
    condition:
        any of them
}

YARA – PowerShell Kill Script

rule PowerShell_SilentKill_Rhysida
{
    meta:
        description = "Detects Rhysida PowerShell defense-kill scripts"
    strings:
        $vss = "vssadmin delete shadows" ascii
        $stop = "Stop-Process" ascii
        $bypass = "-ExecutionPolicy Bypass" ascii
    condition:
        2 of them
}

How to Defend Against Rhysida

Before an attack

Enforce MFA everywhere (VPN, email, admin accounts)
Block unsigned PowerShell and restrict script execution
Disable exposed RDP or restrict via VPN only
Patch internet-facing systems aggressively
Train users to spot fake software downloads
Segment networks (especially backups and AD)

Backups

Maintain offline or immutable backups
Test restores weekly
Never store backups on the same domain with admin reuse

Detection & monitoring

Hunt for Cobalt Strike beacons
Alert on:
- Shadow copy deletion
- Mass file renaming
- PsExec usage outside IT workflows
Monitor outbound traffic from servers

If You Suspect Rhysida Activity

Isolate affected systems immediately
Disable compromised accounts
Preserve logs and memory for investigation
Do not negotiate directly
Report to:
- FBI / IC3
- CISA / MS-ISAC
Assume data theft occurred — plan response accordingly

Final Takeaway

Rhysida is not smash-and-grab ransomware. It’s slow, deliberate, and patient. By the time encryption happens, the real damage is already done.

If you’re in healthcare, finance, manufacturing, or government, you are a target. Prevention, early detection, and tested backups are the only things that reliably stop this group.

They aren’t slowing down — and December 2025 showed they’re still very active.