MALWARE FAMILY
Rhysida
Internal ID: elf.rhysida
Last seen:Mar 17, 2026
Intelligence Profile
Malware family identifying elf.rhysida. Origin and technical characteristics tracked via Malpedia.
Threat Analysis
Rhysida is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.
Ransomware Victims (5)
CTIWATCH tracks 5 organizations claimed as victims by Rhysida on its data leak site, with attack dates, sectors and countries.
View full victims list →Known Campaigns
Rhysida — Active Campaign March 2026
Rhysida is conducting an active ransomware campaign targeting organizations across 1 country. Primary targets: Manufacturing, Public Sector. 2 confirmed victims recorded in the last 45 days. Campaign appears to have stalled.
🎯 Manufacturing🎯 Public Sector
LOW2026
External References
Quick Facts
TypeMalware Family
Aliases1
Also Known As
elf.rhysida
Research Links
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.