HOMETHREATSRhysida
MALWARE FAMILY

Rhysida

Internal ID: win.rhysida
1
victims
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying win.rhysida. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

Rhysida is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

Ransomware Victims (1)

CTIWATCH tracks 1 organizations claimed as victims by Rhysida on its data leak site, with attack dates, sectors and countries.

View full victims list →

External References

→https://blog.talosintelligence.com/emerging-interlock-ransomware/
→https://blog.talosintelligence.com/rhysida-ransomware/
→https://decoded.avast.io/threatresearch/rhysida-ransomware-technical-analysis/
→https://detect.fyi/rhysida-ransomware-and-the-detection-opportunities-3599e9a02bb2
→https://fourcore.io/blogs/rhysida-ransomware-history-ttp-adversary-emulation
→https://go.recordedfuture.com/hubfs/reports/cta-2024-1009.pdf
→https://go.recordedfuture.com/hubfs/reports/cta-2025-0130.pdf
→https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/
→https://www.at-bay.com/threat-research/rhysida-evading-detection/
→https://www.bleepingcomputer.com/news/security/rhysida-ransomware-behind-recent-attacks-on-healthcare/

Quick Facts

TypeMalware Family
Aliases1

Also Known As

win.rhysida

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Rhysida Victims (1)·Geopolitics Map·Search Rhysida