#StopRansomware: Rhysida Ransomware

Text acquired from the source

Cybersecurity Advisory #StopRansomware: Rhysida Ransomware Last Revised April 30, 2025 Alert Code AA23-319A Related topics: Malware, Phishing, and Ransomware , Cyber Threats and Response Summary Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders detailing various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. Note: Updates to this advisory, originally published November 15, 2023, include: April 30, 2025: The advisory was updated to reflect new IOCs employed by Rhysida associates, as well as remove outdated IOCs and TTPs for effective threat hunting. The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi- State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Rhysida ransomware IOCs and TTPs identified through investigations as recently as December 2024. Rhysida has predominately been deployed against the education, healthcare, manufacturing, information technology, and government sectors since May 2023. The information in this advisory is derived from related incident response investigations and malware analysis of samples discovered on victim networks. FBI, CISA, and the MS-ISAC encourage organizations to implement best practices to defend against ransomware and the Rhysida-specific recommendations in the Mitigations section of this advisory.