--- title: "Rhysida Ransomware: A Sinister Crawl from the Undergrowth | Vorlon Blog: Bite sized breaches" description: Uncover the world of Rhysida ransomware in our latest blog post. Learn about its emergence as a ransomware-as-a-service (RaaS) group, its notable victims, and the cunning tactics it employs to infiltrate organizations. Dive into the evolving nature of Rhysida, its threats, and explore effective strategies to safeguard your systems against this growing cyber menace. image: https://vorlon.io/hubfs/Bite%20Sized%20Breaches%20(y).png --- [Saas Security Blog](https://vorlon.io/saas-security-blog) > Rhysida Ransomware: A Sinister Crawl from the Undergrowth # Rhysida Ransomware: A Sinister Crawl from the Undergrowth [Lauren Lee](https://vorlon.io/saas-security-blog/author/lauren-lee) | Aug 15, 2023 [![Share on linkedin](https://vorlon.io/hubfs/ll-assets/Images/Icons/LinkedIn.svg) ](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Frhysida-ransomware-a-sinister-crawl-from-the-undergrowth%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://vorlon.io/hubfs/ll-assets/Images/Icons/X.svg) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Frhysida-ransomware-a-sinister-crawl-from-the-undergrowth%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Frhysida-ransomware-a-sinister-crawl-from-the-undergrowth%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Rhysida+Ransomware%3A+A+Sinister+Crawl+from+the+Undergrowth+%7C+Vorlon+Blog%3A+Bite+sized+breaches) [![Share on email](https://vorlon.io/hubfs/ll-assets/Images/Icons/envelope.svg) ](mailto:?subject=Check%20out%20https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Frhysida-ransomware-a-sinister-crawl-from-the-undergrowth%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Frhysida-ransomware-a-sinister-crawl-from-the-undergrowth%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Rhysida Ransomware: A Sinister Crawl from the Undergrowth](https://vorlon.io/hs-fs/hubfs/Bite%20Sized%20Breaches%20(y).png?width=1200&height=820&name=Bite%20Sized%20Breaches%20(y).png) ## **Introduction** ‍ You've heard of centipedes, but have you heard of Rhysida? No, we're not talking about the creepy-crawly insect. We're diving into the world of Rhysida ransomware, a new and menacing cyber threat that's slithering its way into organizations worldwide. Buckle up, as we unravel the tactics, victims, and what you can do to protect yourself from this digital centipede. ‍ ### **The Rhysida Ransomware: What's the Buzz?** ‍ Rhysida [emerged in May 2023](https://www.sentinelone.com/blog/rhysida-ransomware-raas-crawls-out-of-crimeware-undergrowth-to-attack-chilean-army/) as a ransomware-as-a-service (RaaS) group, and it's been making waves ever since. Named after the Rhysida genus of centipede, this group is anything but slow. They deploy their ransomware via phishing attacks and [Cobalt Strike](https://www.mandiant.com/resources/blog/defining-cobalt-strike-components), threatening to publicly distribute exfiltrated data if the ransom isn't paid. ‍ But what makes Rhysida stand out? It's still in its early stages, but it's already showing its fangs. The ransomware leaves PDF notes on affected folders, claiming that they are “cybersecurity team Rhysida” and instructing victims to pay in Bitcoin. And the sectors they're targeting? Education, government, manufacturing, and technology. They've even started eyeing the Healthcare and Public Health sector. ‍ ### **The Victims: Who's Been Bitten?** ‍ Rhysida's victims are spread across Western Europe, North and South America, and Australia. But let's zoom in on some of the big names: ‍ #### [Chilean Government](https://www.bleepingcomputer.com/news/security/rhysida-ransomware-leaks-documents-stolen-from-chilean-army/): On May 27, the Chilean Army's systems were hit by a security breach. They quickly isolated the network and called in the experts to start fixing things up. But guess what? Local media reported that an Army corporal got arrested and charged for his involvement in the attack. Talk about an inside job! ‍ Now, Rhysida is claiming they've got their virtual hands on some of the Chilean Army's documents, and they've leaked about 30% of them online. That's around 360,000 documents. ‍ #### [Prospect Medical Group: ](https://www.fiercehealthcare.com/providers/ongoing-cyberattack-prospect-medical-holdings-forces-facilities-offline-disrupts-services) The California-based medical group was hit hard by ransomware on August 3. 17 hospitals, 166 outpatient clinics and other practices across several states are still recovering. Can you imagine? The internet, email, and even electronic health records were down, and medical staff were forced to go old school with paper charts. It's like a blast from the past, but not in a fun way.   While the attack hasn't officially been pinned on Rhysida, the whispers are that they might be the culprits. It just goes to show, big healthcare organizations can be a juicy target for ransomware. ‍ Unfortunately, Rhysida's appetite isn't limited to governments and medical groups. They've also feasted on the education, manufacturing, and technology sectors, with education having the most victims.  ‍ ### **Rhysida's Tactics: Slithering into Systems** ‍ Rhysida's tactics are as cunning as a centipede's movement. They exploit known vulnerabilities through phishing campaigns and deploy payloads across compromised systems. Once inside, they run a process that scans files, encrypts them, and changes the file extension to “.rhysida.” ‍ They then leave a ransom note named "CriticalBreachDetected.pdf."  ‍ ![](https://vorlon.io/hubfs/Imported_Blog_Media/64db97a7225a82b292fc3cea_rhysida-2.jpeg) ‍ But they're not just after your money; they threaten to publicly share your stolen data too!  It's a double-whammy, a one-two punch of encryption and extortion. They're not just content to lock up your files; they want to hang them out for the world to see if you don't comply. ‍ What's more, Rhysida's ransomware is still growing, like a centipede adding more legs. It's evolving and adapting, making it a tricky pest to deal with. The malware uses the ChaCha20 algorithm, and while it's missing some features that other ransomware strains have, it's evolving. It's like a creature adapting to its environment, learning new ways to survive and thrive. ‍ ### **Safeguarding Against Rhysida: Building a Fortress** ‍ Feeling the creepy crawlies yet? Don't worry; there are ways to build a fortress against Rhysida: ‍ **Virtual Patching:** This is like putting a band-aid on weak spots in your computer system to keep Rhysida from getting in. ‍ **Phishing Awareness Training:** Teach your team how to spot fake emails and links that Rhysida might use to trick them. ‍ **Endpoint Security Solutions:** Keep a constant watch on all the doors and windows of your computer network to catch and stop any harmful software. ‍ **Immutable Backups:** Make copies of your important files that can't be changed. This way, you can get your data back if Rhysida messes with it. ‍ **Network Segmentation: **Think of this as putting up walls inside your computer network. If Rhysida gets in one room, it can't easily spread to others. ‍ **Firewalls and Intrusion Detection Systems:** These are like security alarms that go off if they spot anything suspicious, helping to block Rhysida. ‍ **Blocking IOCs:** Keep an eye out for specific warning signs (IOCs) linked to Rhysida, and block them. You can find a full list of these warning signs [here](https://www.hhs.gov/sites/default/files/rhysida-ransomware-sector-alert-tlpclear.pdf). ‍ ## **Bottom Line** ‍ Rhysida is a stark reminder that the world of cybersecurity is ever-evolving. With its strong encryption techniques and double extortion tactics, it's a significant threat to organizations worldwide. Stay vigilant, keep your software updated, and remember: in this digital age, everyone is a potential target. Stay safe out there! ‍ About the author ![Lauren Lee](https://vorlon.io/hs-fs/hubfs/Lauren%20Lee%20headshot%20clear%20bg.png?width=120&height=120&name=Lauren%20Lee%20headshot%20clear%20bg.png) [Lauren Lee](https://vorlon.io/saas-security-blog/author/lauren-lee) [Follow me on LinkedIn ](https://www.linkedin.com/in/laurenleeeee/) Lauren Lee is a Sales Engineer at Vorlon with eight years of cybersecurity experience. Before Vorlon, she held a variety of vendor and client-side technical cybersecurity positions, including roles at Palo Alto Networks, Cylance, the U.S. Department ... [Read Full Bio](https://vorlon.io/saas-security-blog/author/lauren-lee) Blog tags - [Bite sized breaches](https://vorlon.io/saas-security-blog/tag/bite-sized-breaches) - [Data breaches](https://vorlon.io/saas-security-blog/tag/data-breaches) [![ShinyHunters Sidebar Ad](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/2026%20CISO%20Report%20Banner%20Ad%20Final.png?width=350&height=520&name=2026%20CISO%20Report%20Banner%20Ad%20Final.png) ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLIFqhHbvMXr9sCtLg3SjGyxucXLDGAEZ6p7hVq%2FHj73J5jIl21ntspuXck0FDhLa5AoCVIiV6UPoFdmfyoCgk5gZhyQN0vNpJbQcKsyBPMqUuCsA79wUgKn%2BCq0jST2BYpRcl6MQO1nqRSUKrW04CR0pGt7umY8qquGOnnq3HJ0%2FYgVqp01i6ughr1Bd0ujJd4m2N8PUt6sJyfXCE46FwKHWOIg3dceObp%2BtoycGA%3D%3D&portalId=24426272) ### Related blogs [View all blogs](https://vorlon.io/blog) [![Capgemini's Data Disaster: When Hackers Turned Consulting into Chaos](https://vorlon.io/hs-fs/hubfs/Bite%20Sized%20Breaches%20(y).png?width=400&height=300&name=Bite%20Sized%20Breaches%20(y).png) Bite sized breaches ### Capgemini's Data Disaster: When Hackers Turned Consulting into Chaos 1 min read Read More ](https://vorlon.io/saas-security-blog/capgeminis-data-disaster-when-hackers-turned-consulting-into-chaos) [![UK Ministry of Defence: “Third-Parties Are the Weakest Link, Goodbye”](https://vorlon.io/hs-fs/hubfs/Bite%20Sized%20Breaches%20(y).png?width=400&height=300&name=Bite%20Sized%20Breaches%20(y).png) Bite sized breaches ### UK Ministry of Defence: “Third-Parties Are the Weakest Link, Goodbye” 2 min read Read More ](https://vorlon.io/saas-security-blog/uk-ministry-of-defence-third-parties-are-the-weakest-link) [![Float Like a Butterfly, Sting Like An OWASP](https://vorlon.io/hs-fs/hubfs/Bite%20Sized%20Breaches%20(y).png?width=400&height=300&name=Bite%20Sized%20Breaches%20(y).png) Bite sized breaches ### Float Like a Butterfly, Sting Like An OWASP 3 min read Read More ](https://vorlon.io/saas-security-blog/float-like-a-butterfly-sting-like-an-owasp) [![The Dawn of Midnight Blizzard](https://vorlon.io/hs-fs/hubfs/Bite%20Sized%20Breaches%20(y).png?width=400&height=300&name=Bite%20Sized%20Breaches%20(y).png) Bite sized breaches ### The Dawn of Midnight Blizzard 2 min read Read More ](https://vorlon.io/saas-security-blog/the-dawn-of-midnight-blizzard) ## Featured resources [![CISO Report Resource Tile](https://vorlon.io/hs-fs/hubfs/CISO%20Report%20Resource%20Tile.webp?width=1548&height=1046&name=CISO%20Report%20Resource%20Tile.webp) WHITE PAPERS AND RESEARCH ### The Agentic Ecosystem SecurityGap: 2026 CISO Report Why 99% of Organizations Were Breached Through Their SaaS and AI Ecosystem Despite Record Security Investment Read more ](https://go.vorlon.io/vorlon-2026-ciso-report-agentic-ecosystem-security-gap) [![blog 451 why saas and ai are converged (1)](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png?width=329&height=222&name=blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png) SaaS Security ### 451 Research: Why AI and SaaS Security Are Converging 451 Research highlights how AI and SaaS security are converging. Learn why integrations, OAuth, and ecosystem-level risk now define enterprise security. Read more ](https://vorlon.io/saas-security-blog/451-research-ai-saas-security-convergence) [![datamatrix patent blog](https://vorlon.io/hs-fs/hubfs/datamatrix%20patent%20blog.png?width=1548&height=1046&name=datamatrix%20patent%20blog.png) ### DataMatrix™: Vorlon's Patented Approach to Agentic Ecosystem Security Vorlon's DataMatrix™ technology is now patented. Learn how this intelligent simulation engine secures the agentic ecosystem by mapping AI agents, SaaS integrations, and data in motion. Read more ](https://vorlon.io/saas-security-blog/datamatrix-vorlons-patented-technology) ## Get Proactive Security for Your Agentic Ecosystem Book a Demo [![Vorlon_Logo_Large_White](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/Vorlon_Logo_Large_White.png?width=139&height=33&name=Vorlon_Logo_Large_White.png) ](https://vorlon.io) ## Sign up for industry insights and Vorlon news Start Here - [The Agentic Ecosystem Security Gap](https://vorlon.io/problems-we-solve) - [The Agentic Ecosystem Signal to Action Layer](https://vorlon.io/our-solution) Platform - [Platform](https://vorlon.io/platform) - [AI Agent Runtime Security](https://vorlon.io/ai-runtime-security) - [Total Identity Security](https://vorlon.io/total-identity-security) - [Data-Centric SaaS Security](https://vorlon.io/data-centric-saas-security) - [Compliance Automation](https://vorlon.io/compliance-automation) - [Apps Directory](https://vorlon.io/app-directory) - [SecOps Integrations](https://vorlon.io/integrations) Company - [About](https://vorlon.io/about) - [Careers](https://vorlon.io/careers) - [Press Room](https://vorlon.io/press-room) - [Resources](https://vorlon.io/resources) - [Blog](https://vorlon.io/blog) Let's Connect - Talk to Sales ![soc-type-2](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/soc-type-2.jpg?width=105&height=50&name=soc-type-2.jpg)![aws logo cropped](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/aws%20logo%20cropped.png?width=50&height=50&name=aws%20logo%20cropped.png)![latio innovators on black](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/latio%20innovators%20on%20black.png?width=52&height=50&name=latio%20innovators%20on%20black.png)![2025-CRN-Stellar-Startups](https://vorlon.io/hs-fs/hubfs/Logo/2025-CRN-Stellar-Startups.webp?width=29&height=50&name=2025-CRN-Stellar-Startups.webp)![FS-ISAC-Seal_Affiliate_onblack](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/FS-ISAC-Seal_Affiliate_onblack.png?width=156&height=50&name=FS-ISAC-Seal_Affiliate_onblack.png) © 2026 Vorlon Inc. All rights reserved. - [Terms of Use](https://vorlon.io/terms-of-use) - [Privacy Policy](https://vorlon.io/privacy-policy) - [Sitemap](https://vorlon.io/sitemap) [![ClickCease](https://monitor.clickcease.com/stats/stats.aspx)](https://www.clickcease.com) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Lauren Lee", "url" : "https://vorlon.io/saas-security-blog/author/lauren-lee" }, "dateModified" : "2024-02-12T11:59:00.205Z", "datePublished" : "2023-08-15T07:00:00.000Z", "headline" : "Rhysida Ransomware: A Sinister Crawl from the Undergrowth | Vorlon Blog: Bite sized breaches", "image" : [ "https://vorlon.io/hubfs/Bite%20Sized%20Breaches%20(y).png" ], "mainEntityOfPage" : { "@id" : "https://vorlon.io/saas-security-blog/rhysida-ransomware-a-sinister-crawl-from-the-undergrowth", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://vorlon.io/hubfs/Logo/Vorlon%20logo_two%20tone%20light.svg" }, "name" : "Vorlon Inc." } } ```