Article
Beyond the Ivory Tower: Darkweb Breach Trends in the Global Education Sector
Darkweb breach trends in education in 2025: how leaked credentials, student data and research files are sold, and what defenders can do about it.
Read more
Ransomware group profile
Rhysida
Also known as Rhysida ransomware
- Active
In short
Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Open source reporting describes it as a ransomware-as-a-service model where any ransom is split with associates. Rhysida uses double extortion: victims pay to decrypt files and pay again to stop stolen data being published.
- StatusActiveas reported
- Other Names1names in public reportsRhysida ransomware
- Entry Routes4ways inVPN with stolen credentials · Gootloader malware · Remote services
- Techniques8mapped to MITRE ATT&CKValid Accounts · External Remote Services
- Defences7first steps listedRequire phishing-resistant MFA · Patch known exploited flaws
Overview
Rhysida is a ransomware family. CISA, the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC) say it has mainly been deployed against education, healthcare, manufacturing, information technology and government organizations since May 2023. They describe the actors as hitting “targets of opportunity”, meaning whoever is exposed, rather than a fixed list. The advisory is based on incident response work and analysis of samples found on victim networks.
How it is run
Open source reporting cited by the agencies describes Rhysida actors working as a ransomware-as-a-service operation, where tools and infrastructure are leased out and any ransom is split between the group and its associates. The same reporting notes similarities with the group known as Vice Society. CISA’s own 2022 advisory on Vice Society said that group was disproportionately targeting the education sector. The advisory states only that similarities exist, not that the two are the same group.
Getting in and moving around
The common way in is a VPN login using valid, stolen credentials, often where multifactor authentication (MFA) was not switched on by default. The April 2025 update adds that the actors have at times used Gootloader malware for the first foothold. After that they rely on built-in Windows tools: Remote Desktop, PowerShell, and commands to list users, groups and domains. They use PsExec heavily for lateral movement, PuTTY for secure shell connections, and AnyDesk for remote access.
- May 2023First deploymentsThe agencies date the use of Rhysida ransomware against victims to this month.
- 10 November 2023Indicators publishedThe advisory notes that technical details and indicators were published on this date and used in its analysis.
- 15 November 2023Advisory publishedCISA, the FBI and the MS-ISAC published AA23-319A.
- December 2024Investigation cut-offThe update draws on investigations up to this month.
- 30 April 2025Advisory updatedNew indicators were added and outdated ones removed, along with newer tools such as AZCopy.
To take over the domain the actors dumped the NTDS.dit database, the file that holds password hashes for every Active Directory user, using secretsdump and the Windows ntdsutil tool. The agencies advise domain-wide password resets, plus a double reset of the Kerberos ticket account, if that file may have been taken. The actors also clear Windows event logs with wevtutil. In 2025 the agencies saw them use the Azure storage tools AZCopy and Storage Explorer. The advisory describes these as tools for copying files to and from Azure storage accounts.
Encryption and extortion
In one investigation the actors made folders named in and out on the C drive. The in folder held host names found by scanning, and scripts then copied the encryptor to each host and ran it. The encryptor uses a 4096-bit RSA key with the ChaCha20 cipher and adds a .rhysida extension. It then deletes itself using a hidden PowerShell command. Rhysida uses double extortion: pay to decrypt, and pay to stop the stolen data being published. Payment is requested in Bitcoin. The ransom note is a PDF named CriticalBreachDetected, with a unique code and a Tor portal to contact the group.
- Model
- Ransomware as a service, with a profit-sharing split
- Active since
- May 2023 (as deployed)
- Main targets
- Education, healthcare, manufacturing, IT, government
- Encryption
- 4096-bit RSA key with ChaCha20
- Encrypted file extension
- .rhysida
- Advisory
- AA23-319A, updated 30 April 2025
The sources opened for this page describe no law enforcement takedown of Rhysida.
Also known as
- Rhysida ransomware
How they get in
-
01
VPN with stolen credentials
The common route is a login to the victim's VPN with valid but compromised credentials, helped by VPNs that lack MFA by default.
-
02
Gootloader malware
The April 2025 update says Rhysida actors have at times used Gootloader malware for initial access.
-
03
Remote services
Actors use external-facing remote services to get in and stay in, then move by Remote Desktop and SSH.
-
04
Living off the land
After the first foothold they use built-in tools such as PowerShell, net commands, nltest and PsExec to blend in.
How they extort
Double extortion. Victims are told to pay in Bitcoin both to decrypt files and to stop stolen data being published. A PDF ransom note points to a Tor portal.
Who they target
-
01
Education
See the industry page -
02
Healthcare
See the industry page -
03
Manufacturing
See the industry page -
04
Information technology
See the industry page -
05
Government
See the industry page
Techniques
- Technique Command and Scripting Interpreter Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs. T1059 · Execution
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Indicator Removal Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind. T1070 · Stealth
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Process Injection Process injection is when an attacker runs their own code inside another program that is already running. T1055 · Stealth, Privilege Escalation
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Notable incidents
How to defend
-
Require phishing-resistant MFA
Turn on MFA for all services, especially webmail, VPN and accounts that reach critical systems. Lack of MFA on VPNs is how many intrusions began.
-
Patch known exploited flaws
Prioritize remediation of known exploited vulnerabilities.
-
Segment the network
Segment networks so ransomware cannot spread freely.
-
Limit command line and PowerShell
Disable command line and scripting where not needed, restrict PowerShell to specific users, and turn on enhanced logging kept for at least 180 days.
-
Restrict Remote Desktop
Allow RDP only for known accounts and groups, with MFA for privileged accounts, closed unused ports and account lockouts.
-
Keep offline backups
Keep offline backups and test restoring them, daily or weekly at minimum.
-
Reset passwords after NTDS theft
If NTDS.dit may have been taken, reset all domain passwords and reset the Kerberos ticket account twice.
Questions
What is Rhysida ransomware?
Rhysida is a ransomware family that CISA, the FBI and the MS-ISAC say has been deployed against victims since May 2023, mainly in education, healthcare, manufacturing, IT and government. Advisory AA23-319A covers it.
How does Rhysida get into networks?
The common route is a VPN login using valid, stolen credentials, often where multifactor authentication was not on by default. The April 2025 update adds that the actors have at times used Gootloader malware for the first foothold.
How does Rhysida extort victims?
It uses double extortion: pay to decrypt, and pay to stop the stolen data being published. Payment is requested in Bitcoin, and the ransom note is a PDF with a unique code and a Tor portal.
Is Rhysida related to Vice Society?
Open source reporting cited by the agencies notes similarities with Vice Society. The advisory states only that similarities exist, not that the two are the same group.
How can I defend against Rhysida?
Turn on phishing-resistant MFA, especially for VPN, patch known exploited flaws, segment the network, restrict Remote Desktop and PowerShell, and keep tested offline backups. Reset domain passwords if NTDS.dit may have been taken.
In our research
- Beyond the Ivory Tower: Darkweb Breach Trends in the Global Education Sector November 2025
- Ransomware Trends Report | Q3 2023 October 2023
Sources
- #StopRansomware: Rhysida Ransomware (AA23-319A) CISA, FBI and MS-ISAC
- #StopRansomware: Vice Society (AA22-249A) CISA, FBI and MS-ISAC
- #StopRansomware Guide CISA
- Stop Ransomware CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.