Assessment at a glance
Identity: Rhysida ransomware and associated deployment activity. Model: ransomware-as-a-service behaviour is documented in open-source reporting cited by the joint government advisory. Motivation: extortion, using double extortion (encryption plus threatened publication of exfiltrated data). Naming: no numbered APT or universal CrowdStrike/Microsoft actor alias is assigned here. Microsoft's detection page lists no associated aliases. A malware detection label is not an actor identity.
Currency limit: the newest primary material reviewed is the FBI/CISA/MS-ISAC advisory AA23-319A (15 November 2023, covering investigations as recently as September 2023) and Microsoft's detection page (published 4 August 2023, updated 25 January 2024). No post-2024 primary evidence was reviewed. The technical detail below is historical evidence; this profile does not present it as proof that any tool or indicator remains in use in October 2026. New incidents require fresh evidence.
Evidence and targeting
The advisory describes Rhysida as an emerging variant deployed since May 2023 against "targets of opportunity" in education, healthcare, manufacturing, information technology and government. It notes open-source reporting of similarities between Vice Society (Microsoft: DEV-0832) activity and the actors observed deploying Rhysida, and reporting of Rhysida actors operating as a ransomware-as-a-service, with ransoms split between the group and affiliates. Similarity is weaker than established identity equivalence: this profile does not rename Rhysida as Vice Society or transfer every Vice Society attribution to it. Joint advisory
Microsoft dates Rhysida's first appearance to May 2023. For the analysed Windows threat it describes ChaCha20 encryption, the .rhysida extension and a ransom note named CriticalBreachDetected.pdf. It also lists folders the encryptor skips (for example Windows, Program Files, ProgramData, Recovery and System Volume Information) and extensions it skips (for example .exe, .dll, .sys, .msi, .ps1 and .iso). These are sample-level observations. An extension or note cannot identify the person or affiliate responsible for an intrusion. Microsoft analysis
Intrusion behaviour (as reported in 2023)
Initial access. The advisory records actors authenticating to internal VPN access points with compromised valid credentials, noting organisations lacking MFA enabled by default. It also records exploitation of Zerologon (CVE-2020-1472), a Netlogon elevation-of-privilege vulnerability for which Microsoft released a patch on 11 August 2020, and successful phishing. Joint advisory
Living off the land and discovery. Reported activity includes RDP for lateral movement, PowerShell, PsExec (described as heavily used for lateral movement and remote execution), and PuTTY for SSH connections. Native commands (ipconfig, whoami, nltest and several net commands) were used to enumerate users, domain computers, domain admins, local administrators and domain trusts. PowerView was used for further reconnaissance and credential harvesting.
Credential access. secretsdump and ntdsutil.exe were used for NTDS dumping (T1003.003), extracting the NTDS.dit database containing hashes for all Active Directory users.
Defence evasion. wevtutil.exe was used to clear a significant number of Windows event logs, including system, application and security logs (T1070.001). Registry modification commands and hidden PowerShell windows were also reported. The encryptor binary is deleted after encryption.
Staging and encryption. In one investigation, actors created in and out folders on the C:\ drive as a staging directory. The in folder held file names matching victim host names. The out folder held the encryptor (conhost.exe), PsExec and batch scripts (S_0.bat, S_1.bat, S_2.bat) that copied the binary to each listed host's C:\Windows\Temp directory and executed it. Encryption uses a 4096-bit RSA key with ChaCha20, appending .rhysida to encrypted files.
Extortion. Actors reportedly engage in double extortion, direct payment in Bitcoin, and provide a unique code and Tor-portal instructions in the PDF ransom note.
This is a collection of observed techniques, not a mandatory sequence or attribution checklist.
TIR assessment: legitimate administration tools make context decisive. PsExec execution from an authorised management server during maintenance differs from new remote execution by a recently compromised VPN identity. Detection should join identity, source host, target and administrative intent. Executable names alone create noise and miss the trust relationship being abused.
Persistence and dwell time
The advisory documents several persistence mechanisms. Actors leveraged external-facing remote services, such as VPNs, "to initially access and persist within a network". AnyDesk was observed being used to obtain remote access and maintain persistence (T1219). The advisory also lists PortStarter, a back door script written in Go that modifies firewall settings and opens ports to pre-configured command-and-control servers, attributed to reporting on Vice Society-related activity. All of this is dated 2023.
Because access can rely on valid credentials and legitimate remote-access software, removing the encryptor does not by itself remove the actors' access. The retained sources do not establish a representative dwell-time statistic.
TIR assessment: distinguish first observed access from first known malicious use, and both from encryption. Because actors cleared event logs with wevtutil, gaps in telemetry may be adversary-created rather than benign. When logs are incomplete, report the earliest evidenced time and the uncertainty interval. Missing older telemetry does not prove a recent compromise. Review remote access, privileged identities and backup administration before declaring recovery complete.
Indicators (historical, November 2023)
The advisory lists C2 IP addresses derived from Sophos investigations, for example 5.39.222[.]67, 5.255.99[.]59, 51.77.102[.]106, 108.62.118[.]136, 108.62.141[.]161, 146.70.104[.]249, 156.96.62[.]58 and 157.154.194[.]6, and contact addresses on onionmail[.]org (rhysidaeverywhere@onionmail[.]org, rhysidaofficial@onionmail[.]org). These are dated 2023 reporting and are not current blocking guidance; use them for retrospective hunting only. The advisory also publishes SHA256 hashes and a downloadable STIX file.
Detection and recovery
TIR recommendations: investigate newly observed VPN source networks, privileged logins outside established patterns and rapid transitions from remote access to domain reconnaissance. Look for unexpected administrative execution across hosts, cleared event logs, unauthorised remote-access software and attempts to reach backup infrastructure. Confirm legitimate ownership while retaining evidence needed to reconstruct the sequence.
Preserve ransom notes and file metadata, but base containment on the intrusion rather than its branding. Revoke sessions and rotate credentials from trusted systems. Where there is any indication that NTDS.dit was compromised, the advisory strongly recommends domain-wide password resets and double Kerberos TGT (krbtgt) password resets. Also check whether credentials were shared with service accounts or recovery tools. Prioritise essential operational functions and exercise restoration before returning production trust.
The advisory recommends phishing-resistant MFA for webmail, VPN and critical-system access, prompt patching of known exploited vulnerabilities, network segmentation, restricted PowerShell and RDP, enhanced PowerShell logging, and encrypted, immutable offline backups. Microsoft recommends recoverable backups and tamper protection, among other controls. These reduce exposure but do not determine how access was gained. A backup is useful only if restoration avoids reintroducing compromised identities or configurations. Joint advisory Microsoft analysis
Update record
Version 1 — 30 October 2026: initial profile based on AA23-319A (15 November 2023) and Microsoft's detection page (updated 25 January 2024). No post-2024 primary evidence was reviewed. Preserves evidence dates and distinguishes malware classification from actor identity and reported overlap from a conclusive alias.