Rhysida is a financially motivated ransomware operation first observed in May 2023. A joint FBI, CISA and MS-ISAC advisory describes actors using Rhysida against targets of opportunity and says some deployments operated under a ransomware-as-a-service model. The name continued to appear in public victim claims in 2025, including a claim involving Bellflower Unified School District.
Researchers have reported operational similarities between Rhysida and Vice Society, but the public evidence does not establish that the names identify the same operators. No reviewed authoritative source publicly identifies Rhysida’s members, location or a state sponsor.
The 2023 joint advisory documented Rhysida deployments against education, health care, manufacturing, information technology and government organizations. It characterized the victims as targets of opportunity rather than evidence of a single narrow sector campaign. Later victim claims show the brand persisted beyond its initial 2023 emergence, but a leak-site listing is an allegation and does not by itself prove intrusion, encryption or data theft.
FBI, CISA and MS-ISAC observed Rhysida actors authenticating to virtual private network services with compromised credentials, particularly where multifactor authentication was absent. They also documented phishing and exploitation of the Zerologon vulnerability, CVE-2020-1472, while noting that methods may vary by intrusion.
Inside victim networks, observed activity has included PowerShell, Windows command-line utilities, Remote Desktop Protocol, PuTTY, PsExec and AnyDesk. The actors have used tools such as secretsdump and ntdsutil to obtain credentials, PowerView and native commands for discovery, and wevtutil to clear Windows event logs. Rhysida operations combine system encryption with threats to publish stolen data. A Kookmin University and Korea Internet & Security Agency study found that analyzed Rhysida samples used intermittent encryption and contained a key-generation weakness that enabled the researchers to build a recovery method; that finding applies to the studied samples and should not be assumed to cover every build.
Rhysida is best classified as a financially motivated ransomware group. Government reporting supports the use of an affiliate or profit-sharing model in at least some activity, but the size, leadership and consistency of that structure remain unknown. Reported overlap with Vice Society is an investigative lead, not a confirmed identity relationship, and the reviewed evidence does not support state attribution.
Rhysida listed Bellflower Unified School District on its data-leak site on October 28, 2025. Later reporting said Bellflower employee tax and payroll files appeared in the published material, supporting possession of district data but not independently proving that Rhysida conducted the original intrusion or used encryption.
