rhysida
ransomware group · aka Rhysida, Rhysida ransomware, possible Vice Society overlap (suspected by some vendors, unconfirmed) · unknown; no confirmed attribution. Some vendor reporting (2023) suggested tooling or operational overlap with the Vice Society actor based on shared TTPs, but a direct link remains unconfirmed. · active since May 2023 (per vendor research)
Victims · 7d
3▲1 vs prev. week
Victims · 30d
12active targets
Victims · 90d
15
All-time (tracked)
288since 2023-06-09
Last post
09-12 15:39UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Rhysida is a ransomware and double-extortion group first publicly observed in May 2023, operating an affiliate-style model and publishing stolen data on a Tor leak site. It is known for high-profile attacks on public-sector and critical-service targets, including Prospect Medical Holdings, the British Library, and the Chilean Army (all 2023). Several researchers have suggested overlap with the Vice Society actor, citing shared tactics such as intermittent encryption, though this remains unconfirmed. Per this dashboard, the group's leak site posted 2 victims in the past 30 days, most recently on 2026-09-08, including publication of stolen Berlin state government login credentials after a reported €2 million extortion demand was refused (news reporting, 2026). No comprehensive public earnings estimate for the group has been identified.
Tactics & tooling
- Initial access via phishing emails with malicious links or attachments (vendor reporting, 2023)
- Use of legitimate remote monitoring/management and remote-access tools in intrusions
- Double extortion: data exfiltration followed by publication on a Tor leak site
- Public auctions of stolen victim data on cybercrime markets (reported 2023, e.g., Prospect Medical Holdings)
- C-based ransomware encryptor using ChaCha20 for file encryption with RSA-4096-protected keys (analyst analyses, 2023)
- Intermittent/partial encryption in some incidents, a technique also associated with the Vice Society actor
- Recruitment of affiliates via cybercrime forums (reported 2023)
- Targeting skewed toward healthcare, education, government, and cultural institutions, though activity is opportunistic
Targeted sectors
HealthcareEducation and cultural institutionsGovernment and public sectorPublic health agenciesMultiple verticals (opportunistic)
Notable public victims
Prospect Medical Holdings (US healthcare; 2023; breach and reported data auction covered by media/vendor reporting), British Library (UK; 2023; reported £600,000 (~$750,000) demand refused; data published), Chilean Army (2023), Southern Nevada Health District (US; 2023; incident confirmed by the agency), Berlin state government (Germany; 2026; reported €2 million demand refused; stolen credentials published per news reporting), Leak-site listings tracked by this dashboard (2026): SAD'S Interim; Rug & Home
Estimated earnings
No public figure.
Leak-site victims288 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Ramtha | · Aug 9, 2023 | Ramtha The teachings of Ramtha are a unique science. More |
| United Tractors | · Aug 3, 2023 | United Tractors United Tractors is a heavy equipment distribution company headquartered in Jakarta, Indonesia. More |
| ESMOD | · Jul 29, 2023 | ESMOD ESMOD, founded by master tailor Alexis Lavigne, has been one of the most prestigious fashion universities in the world since the first students crossed its threshold in 1841. Documents Data Catalog: 436 GB, 193 453 Files 100% All files was uploaded to public access, data hunters, enjoy More |
| ESKA Erich Schweizer | · Jul 28, 2023 | ESKA Erich Schweizer ESKA is a leading German manufacturer of all types of fuses and passive components. More |
| Rouzbeh Educational Complex | · Jul 28, 2023 | Rouzbeh Educational Complex The industry in which Rouzbeh Educational Complex operates is educational institution. The country where Rouzbeh Educational Complex is located is Iran, while the company's headquarters is in Tehran. Documents Data Catalog: 2.5 GB, 13 Files 100% All files was uploaded to public access, data hunters, enjoy More |
| University of Salerno | · Jul 26, 2023 | University of Salerno The University of Salerno is a university located in Fisciano and in Baronissi, Italy. Its main campus is located in Fisciano while the Faculty of Medicine is located in Baronissi. More |
| University of the West of Scotland | · Jul 25, 2023 | University of the West of Scotland University of the West of Scotland was recently named Higher Educational Institution of the Year, at the 2022 Herald Higher Education Awards and is one of Scotland's largest modern universities. More |
| Axity | · Jul 22, 2023 | Axity Axity is one of the leading IT companies in Latin America and home to the best talent. More |
| Lumberton Independent School District | · Jul 19, 2023 | Lumberton Independent School District Lumberton Independent School District is a public school district based in Lumberton, Texas. In addition to Lumberton, the district serves the city of Rose Hill Acres. More |
| IRIS Informatique | · Jul 17, 2023 | IRIS Informatique IRIS Informatique is a team of experts with many areas of expertise: Helpdesk, IT Logistics, IT Repair and Recycling, delegation of IT resources, etc. More |
| ICT-College | · Jul 17, 2023 | ICT-College ICT-College's experienced staff are always available to help and answer questions. More |
| Stephen F. Austin State University | · Jul 16, 2023 | Stephen F. Austin State University Stephen F. Austin State University is a public university in Nacogdoches, Texas. More |
| Caterham High School | · Jul 14, 2023 | Caterham High School Caterham High is a community school that serves a richly diverse area of East London, with many ethnic groups and languages represented. More |
| The Big Life group | · Jul 14, 2023 | The Big Life group Big Life is in the business of changing lives. We fight inequality by working with people and places to create opportunities and inspire change. More |
| Citta Nuova | · Jul 10, 2023 | Citta Nuova Citta Nuova is an Italian publishing house established in Rome in 1959. More |
| Kenya Bureau Of Standards | · Jul 7, 2023 | Kenya Bureau Of Standards The Kenya Bureau of Standards (KEBS) has remained the premier government agency for the provision of Standards, Metrology and Conformity Assessment (SMCA) services since its inception in 1974. More |
| Ayuntamiento de Arganda City Council | · Jul 3, 2023 | Ayuntamiento de Arganda City Council Located in the southeast of the Community of Madrid, 25 kilometers from Madrid capital, Arganda del Rey can boast of having an extremely interesting natural environment, since part of its municipal district is included in the 'Parque Regional del Sureste', as well as having large green areas and particular ecosystems of remarkable environmental richness. More |
| Hollywood Forever | · Jul 3, 2023 | Hollywood Forever Hollywood Forever is a full-service funeral home, crematory, cemetery, and cultural events center in the heart of Hollywood. More |
| BM GROUP POLYTEC S.p.A. | · Jul 3, 2023 | BM GROUP POLYTEC S.p.A. Polytec is the merger of two leading companies in automation, robotics , renewable energy and plant engineering, an internationally renowned company operating in the field of system integration, specializing in solutions and platforms that combine robotics, artificial intelligence, process automation and software to help manufacturing companies achieve the technological transformation they need to become smart factories. More |
| Western National Group | · Jun 30, 2023 | Western National Group Experts in the Western US multifamily real estate industry, Western National Group is an outstanding curator of investment opportunities, a team of industry-leading builders, and an accredited property management company. More |
| Enfield Grammar School | · Jun 30, 2023 | Enfield Grammar School Enfield Grammar School is a boys' Comprehensive school and sixth form with academy status, founded in 1558, situated in Enfield Town in the London Borough of Enfield in North London. Documents Data Catalog: 18 GB, 76 Files 20% Not sold data was uploaded, data hunters, enjoy More |
| Alberta Newsprint | · Jun 29, 2023 | Alberta Newsprint Founded in 1989, Alberta Newsprint is a manufacturer of premium newsprint and high bright paper. Documents Data Catalog: 28 GB, 45 785 Files 40% Not sold data was uploaded, data hunters, enjoy More |
| iMatica | · Jun 27, 2023 | iMatica iMatica was born in 2001 in Girona and we have expanded throughout the peninsula to provide more and better service. The specialty of the house is the implementation of business management software, also called ERP or billing and accounting program. Documents Data Catalog: 717 GB, 568 473 Files 90% Not sold data was uploaded, data hunters, enjoy More |
| Hochschule Kaiserslautern | · Jun 27, 2023 | Hochschule Kaiserslautern The Kaiserslautern University of Applied Sciences is a Hochschule (University of Applied Sciences) with 3 campuses located in Kaiserslautern, Germany, in Pirmasens, Germany and in Zweibrucken, Germany. Documents Data Catalog: 241 GB, 294 254 Files 40% Not sold data was uploaded, data hunters, enjoy More |
| Fassi Gru S.p.A. | · Jun 26, 2023 | Fassi Gru S.p.A. Fassi Gru S.p.A. - Loader cranes manufacturer since 1965. Fassi Gru is the market leader among Italian producers. Its product range and sales numbers place it among the top producers of hydraulic cranes in the world. Documents Data Catalog: 490 GB, 1 120 626 Files 100% All files was uploaded to public access, data hunters, enjoy More |
| Avannubo | · Jun 22, 2023 | Avannubo Global provider of technological services with an official license for IP telephony, mobile phones and Internet access. Documents Data Catalog: 165Gb, 198760 Files 100% All files was uploaded to public access, data hunters, enjoy More |
| SAPROS | · Jun 20, 2023 | SAPROS Sapros is a manufacturer, and supplier of food products like salads, vegetables, fruit and high-quality antipasti. Documents 100% All files was uploaded to public access, data hunters, enjoy More |
| EDER | · Jun 18, 2023 | EDER The EDER group of companies includes the brick plants in Peuerbach and Weibern, four ready-mixed concrete plants in Upper Austria, Systembau Eder with prefabricated stairs, constructive concrete components and double-wall systems for industrial building construction and its own vehicle fleet. Documents 100% All files was uploaded to public access, data hunters, enjoy More |
| Tyconz | · Jun 18, 2023 | Tyconz Founded in 2011, TYCONZ has become one of the most experienced SAP-certified consultancy firms. Documents 100% All files was uploaded to public access, data hunters, enjoy More |
| Ziegelwerk Eder | · Jun 17, 2023 | Ziegelwerk Eder In 1996, the Upper Austrian family company EDER built a state-of-the-art brick factory in Freital near Dresden. Documents 100% All files was uploaded to public access, data hunters, enjoy More |
| Koper Automatisering | · Jun 15, 2023 | Koper Automatisering Koper Automatisering specializes in the development of specialized software for the food industry and floriculture. Documents 100% All files was uploaded to public access, data hunters, enjoy More |
| Paris High School | · Jun 12, 2023 | Paris High School Paris High School is a learning community dedicated to developing well-rounded, productive, engaged citizens in a safe and supportive environment. More |
| Northeastern State University | · Jun 12, 2023 | Northeastern State University Northeastern State University is a public university with its main campus in Tahlequah, Oklahoma. More |
| Ejercito de Chile | · Jun 10, 2023 | Ejercito de Chile The Army of Chile is the branch of the Armed Forces of Chile in charge of the land defense of Chile, whose mission is to maintain the external security, sovereignty and territorial integrity of the Republic. More |
| Haemokinesis | · Jun 9, 2023 | Haemokinesis Haemokinesis specializes in research and development, laboratory systems, sales and distribution of immunohematology products. Documents 100% all files was uploaded to public access, data hunters, enjoy More |
| Amstutz Produkte | · Jun 9, 2023 | Amstutz Produkte AMSTUTZ PRODUKTE AG is a leading Swiss manufacturer of chemicals and technical equipment for chemical applications. Documents 100% all files was uploaded to public access, data hunters, enjoy More |
| The Thomas Hardye School | · Jun 9, 2023 | The Thomas Hardye School The Thomas Hardye School is a secondary academy school in Dorchester, Dorset, England. It is also part of the DASP group. Documents 100% all files was uploaded to public access, data hunters, enjoy More |
| Collectivite Territoriale de Martinique | · Jun 9, 2023 | Collectivite Territoriale de Martinique The territorial collectivity of Martinique is a single French territorial collectivity that succeeds the overseas department and region of Martinique in all their rights and obligations on January 1, 2016. Documents 100% all files was uploaded to public access, data hunters, enjoy More |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .