Podcasts
Rhysida
Active Since
May 2023
Total victims as of January 2024
73
Known Forum Aliases
N/A
Active Forum Accounts
N/A
Targeted Geographies
US, UK, Italy
Rhysida has quickly risen to notoriety due to high profile attacks on the organizations such as the British Library, which took the cherished UK institution’s website, systems, and some on-site services offline.
Just weeks later, the gang took aim at another British institution – the royal family – threatening to leak data from a private London hospital, which it claimed contained sensitive information on the royals.
The group is noteworthy for its focus on organizations in the education industry, followed by those in health care equipment & services, and the public sector.
Some cybersecurity analysts have identified similarities in the Tactics, Techniques and Procedures (TTPs) of Rhysida and those used by Vice Society. Other correlatory factors include temporal crossover – after Rhysida’s appearance only two victims were posted on Vice Society’s leak site before it stopped being active – and similarity in victimology.
Related Content
The Dark Web Hub
Vice Society [offline]
Vice Society stopped posting victims to its dark web leak site in June 2023 and went offline in December. Some security analysts note similarities in the TTPs of Vice Society and those used by Rhysida.
The Dark Web Hub
Royal [offline]
Royal initially used third-party ransomware including BlackCat and Zeon before developing its own malware, written in C++, which infects Windows systems.
The Dark Web Hub
Play
Play keeps a fairly low profile on the dark web aside from its leak site, not advertising via forum accounts and recently had to fend off accusations it had introduced a RaaS model.
The Dark Web Hub
BlackBasta
BlackBasta is a ransomware operation that is notable for its high volume of attacks, use of custom tools, and suspected links to cybercriminal group FIN7.
The Dark Web Hub
Akira
Akira appears to be a novel ransomware, written in C++, with versions targeted both at Windows machines and Linux operating systems. It has quickly become one of the most prolific ransomware groups.
Videos
