Rhysida Ransomware Decryption & Data Recovery

Rhysida was publicly identified in May 2023, with activity traced back to early that year. It runs as ransomware-as-a-service: a core team supplies the encryptor, negotiation portal and leak site, while affiliates handle intrusion and deployment for a share of the ransom. CISA, the FBI and MS-ISAC published joint advisory AA23-319A in November 2023 and refreshed its indicators in April 2025, a sign the crew keeps rotating infrastructure.

Victimology marks Rhysida as an opportunistic actor that picks weaknesses rather than verticals. Education, healthcare, manufacturing, IT and government dominate its leak site; roughly half of the named organisations are US-based, with Europe growing year on year. Posting continued at a steady pace through 2025 and into 2026, so the group should be treated as currently active rather than historical.

Researchers broadly accept a lineage between Rhysida and the now-quiet Vice Society, with Sophos documenting near-identical tradecraft across both brands. IBM X-Force goes further and describes overlap between Rhysida and Interlock in the Supper backdoor, crypters and the traffic distribution systems used for delivery.

For Chinese enterprises the lesson is how ordinary the entry points are: VPN accounts without MFA, internet-exposed edge appliances and directly reachable hypervisor management interfaces. No public report confirms a targeted Rhysida campaign against mainland China organisations, but overseas subsidiaries and cross-border branches of Chinese groups sit squarely inside its target space.

Extension and naming. Encrypted files get .rhysida appended to the full original name, so report.xlsx becomes report.xlsx.rhysida. The base filename is not rewritten or randomised, which distinguishes Rhysida from renaming families such as DragonForce or Makop.

Ransom note. A PDF named CriticalBreachDetected.pdf is dropped in affected directories. The English text presents the actors as the "Rhysida cybersecurity team", claims they located and exploited a flaw in the victim network, and supplies a unique victim code plus a Tor portal address. No email address is provided; negotiation happens only through the onion site.

Other indicators.

• Wallpaper is usually untouched, but some builds print the note to attached printers.
• Domain environments typically show mass deployment of the encryptor via PsExec or a GPO.
• Cobalt Strike, SystemBC and PortStarter artefacts often appear on staged hosts before encryption.
• Appearance on the Rhysida leak site with a sample data pack confirms exfiltration has already happened.

Bottom line. The .rhysida extension together with CriticalBreachDetected.pdf is enough to attribute the family, but whether the free decryptor applies depends on the specific build, so a real sample must be analysed before any claim about recoverability.

Rhysida's access playbook leans on valid credentials and exposed edge devices - technically unremarkable, operationally effective:

• VPN accounts without MFA. Both the CISA advisory and Sophos rank this as the primary vector; credentials come from password reuse, infostealer logs and dark-web purchases.
• Vulnerabilities in perimeter services. Known flaws in VPN gateways, remote access and file transfer appliances are exploited for a foothold.
• Phishing. Loader delivery followed by a Cobalt Strike beacon.
• Malvertising and SEO poisoning (since October 2025). Fake Microsoft Teams download sites (teams-install[.]top, teams-download[.]buzz) serve a signed MSTeamsSetup.exe that installs the Oyster/Broomstick backdoor, from which Rhysida is deployed; Microsoft has revoked over 200 of the abused signing certificates. The April 2025 revision of the CISA advisory additionally documents Gootloader as an initial access vector and the use of AZCopy and Storage Explorer to exfiltrate to cloud storage.
• Lateral movement. Cobalt Strike, PsExec, RDP and stolen domain administrator credentials; the domain controller is frequently taken first so the encryptor can be pushed everywhere at once.
• Privilege escalation and defence evasion. Credential dumping and ntdsutil for domain hashes, followed by disabling or uninstalling endpoint protection.
• Exfiltration. Archiving plus cloud sync or transfer utilities before encryption, setting up the double-extortion leverage.

Rhysida operators typically dwell for days or weeks, mapping the backup system and hypervisor estate before detonating during a business trough - a weekend or a public-holiday night. "Nothing boots on Monday morning" is therefore the most common way these incidents are first reported.

Algorithms. File content is encrypted with ChaCha20; each per-file symmetric key is wrapped with a 4096-bit RSA public key. Key material is never written in cleartext, so without the operators' private key there is nothing to reverse.

Intermittent encryption. Rhysida encrypts only part of each file to gain speed. For large files this is significant: database files, virtual disks and mail stores may retain substantial untouched regions, which leaves room for structural repair. How much is recoverable depends entirely on the stride used and whether critical headers or page structures were hit, so it has to be measured on the actual files.

Recovery inhibition. Volume shadow copies are deleted, event logs cleared, database and backup agent services stopped, and directly reachable backup storage is attacked where possible.

Virtualisation. A Linux/ESXi encryptor encrypts vmdk, vmx and related files under /vmfs/volumes. One compromised host equals every VM on it going down, which is why ESXi cluster incidents produce such outsized losses.

Double extortion. Data is stolen before encryption; non-payment leads to staged publication on the leak site and direct pressure on the victim's customers and regulators.