Also known as: Rhysida Ransomware, Vice Society (suspected connection), OysterLoader operators, Broomstick operators, CleanUpLoader operators
Profile generated with AI assistance — review before citing.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
External Remote Services
Abuse remote services like VPNs or RDP to gain access to the network.
Phishing
Send deceptive messages to trick victims into executing malicious content.
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Malware used by Rhysida.
Legitimate tool used by Rhysida.
Legitimate tool used by Rhysida.
Malware used by Rhysida.
Legitimate tool used by Rhysida.
Legitimate tool used by Rhysida.
Malware used by Rhysida.
Malware used by Rhysida.
Malware used by Rhysida.
Open-source credential harvesting tool used to extract passwords from compromised systems
Legitimate remote desktop software abused for persistence and remote access
| Type | Value |
|---|---|
| hash | 8b5078c9f0f1e2e20f8c0b4d35c6a7b9f5e8d2c1a4b7f9e3d6c8a5b2f1e4d7c9 |
| hash | 8886c554ba622c0a8b43723e8ba2e2c26bfb88e7 |
| domain | rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad[.]onion |
| domain | rhysida7vbobdhtoxmtyy43kkmvxqjsklpnhkpwzrhzlx3s6jqjqhid[.]onion |
| url | hxxp[[://]]rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad[.]onion/blog |
| hash | 3d5a5b7e8f9c2d1a4b6e8f7a9c2d5e1f3a4b6c8d9e1f2a3b5c7d8e9f1a2b3c4 |
| hash | 7ff5d30d00ce9d2dd694814d25e3c886ed83e126f884daa6e2c8c13ce0684deb |
| hash | d0a43787c92c89bf0ed4927303c4a2d4e07e8a4e |
| hash | 7a8f8c3e2e8f9a5b3c1d4e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b |
| hash | 8b9f6a8c2e3d5f7a9b1c4e6d8f0a2b4c6e8f0a1b3c5d7e9f0a2b4c6d8e0f1a3b |
| Domain / Host | Status |
|---|---|
codeforprofessionalusers[.]com | offline |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
CISA Cybersecurity Advisory: #StopRansomware: Rhysida Ransomware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
Microsoft Threat Intelligence: Rhysida Ransomware
https://www.microsoft.com/en-us/security/blog/threat-intelligence/
Health Sector Cybersecurity Coordination Center (HC3): Rhysida Ransomware Threat Profile
https://www.hhs.gov/sites/default/files/rhysida-ransomware-analyst-note.pdf
Cisco Talos: Rhysida Ransomware Analysis
https://blog.talosintelligence.com/rhysida-ransomware/
MITRE ATT&CK: Rhysida Software
https://attack.mitre.org/software/S1073/
Cybereason: Rhysida Ransomware: A Comprehensive Technical Analysis
https://www.cybereason.com/blog/threat-analysis-rhysida-ransomware
FBI Flash: Rhysida Ransomware
https://www.ic3.gov/Media/News/2023/231115.pdf
CheckPoint Research: Rhysida Ransomware: In-Depth Analysis
https://research.checkpoint.com/2023/rhysida-ransomware-in-depth-analysis/
FBI Flash Report: Rhysida Ransomware
https://www.ic3.gov/Media/News/2023/231120.pdf
Analysis of Rhysida Ransomware
https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html
Rhysida Ransomware Group Profile 2026 Analysis - Ransom-DB
https://www.ransom-db.com/blog/rhysida-ransomware-group-profile-2026-analysis
Rhysida Ransomware: Recent U.S. Breaches And Mitigation - BlackFog (December 2025)
https://www.blackfog.com/rhysida-ransomware-us-breaches-and-mitigation/
RHYSIDA Ransomware Strikes Again - Breached.Company (February 2026)
https://breached.company/rhysida-ransomware-strikes-again-leading-edge-speciali-added-to-leak-site-as-groups-relentless-campaign-continues/
Certified OysterLoader: Tracking Rhysida via Code-Signing Certificates - Expel (December 2025)
https://expel.com/blog/certified-oysterloader-tracking-rhysida-ransomware-gang-activity-via-code-signing-certificates/
Outmaneuvering Rhysida - Recorded Future (October 2024)
https://www.recordedfuture.com/research/outmaneuvering-rhysida-advanced-threat-intelligence-shields-critical-infrastructure-ransomware
Rhysida Ransomware Evasion Tactics - At-Bay (November 2025)
https://www.at-bay.com/threat-research/rhysida-evading-detection/
Gootloader Threat Detection - Huntress (November 2025)
https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation
Rhysida Ransomware: Tracking the Emergence and Evolution of a New Threat
https://www.fortinet.com/blog/threat-research/rhysida-ransomware-tracking-emergence-evolution-new-threat
Rhysida Ransomware Deep Dive
https://www.zscaler.com/blogs/security-research/rhysida-ransomware-deep-dive
Microsoft Trusted Signing Abuse by Rhysida Group
https://www.bleepingcomputer.com/news/security/microsoft-revokes-200-certificates-abused-by-rhysida-ransomware-gang/
Rhysida Ransomware Threat Profile
https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-rhysida
The Rhysida Ransomware Activity Analysis
https://www.sentinelone.com/labs/rhysida-ransomware-a-threat-actor-profile/
Rhysida Ransomware: Threats, Tactics, and Defense Strategies
https://www.sentinelone.com/blog/rhysida-ransomware-threats-tactics-and-defense-strategies/
Rhysida Ransomware: Analysis and Protection Guidance
https://www.trendmicro.com/en_us/research/23/k/rhysida-ransomware-actors-suspected-of-attacking-the-british-lib.html
Rhysida Ransomware: Analyzing the Threat and Its Tactics
https://www.trendmicro.com/en_us/research/23/k/rhysida-ransomware-analyzing-the-threat-and-its-tactics.html
Rhysida Ransomware Group Emerges as Major Threat in 2024
https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/rhysida-ransomware/