Rhysida

Also known as: Vice Society

Overview

Ransomware group targeting healthcare, education, and government. Known for auctioning stolen data. Linked to former Vice Society operators.

MITRE ATT&CK Coverage

Recon
Res Dev
Init Access
Execution
Persistence
Priv Esc
Def Evasion
Cred Access
Discovery
Lat Move
Collection
C2
Exfil
Impact
3 of 14 tactics observed

Raw TTPs

RansomwareData AuctionPhishingVPN ExploitationCobalt Strike

Related Intelligence (2)

HIGHRansomware

Be on the lookout for Mistic, a new backdoor used by ransomware broker

Researchers have identified a new backdoor program that has been used in enterprise intrusions since April and appears to be linked to an initial access broker that sells network footholds to ransomware gangs. Dubbed Mistic by researchers from Symantec , the malware program has been deployed on networks belonging to organizations from multiple sectors, including insurance, education, IT, and profe

CSO Online
HIGHRansomware

New ‘Mistic’ RAT Opens Door to Several Ransomware Families

Mistic is used by Woodgnat, an initial access broker working with Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. The post New ‘Mistic’ RAT Opens Door to Several Ransomware Families appeared first on SecurityWeek .

SecurityWeek