3 malware familiesExploits CVEs in the wild

Rhysida

Also known asrhysida

Rhysida is a financially motivated ransomware group active since at least May 2023 that operates as a Ransomware-as-a-Service platform. Reporting in the provided content describes Rhysida as notable for extorting healthcare organizations and other critical infrastructure, with healthcare, education, and government also cited among affected sectors. Most victims referenced in one IBM X-Force analysis were in the United States. The group has been linked to incidents affecting healthcare organizations and public-sector entities, including claims around Prospect Medical Holdings, Cookeville Regional Medical Center, Columbus city systems, and an airport attack referenced in the content. The content links Rhysida to several upstream criminal service providers and tooling ecosystems. Multiple reports state that the initial access broker Woodgnat, also known as KongTuke, has sold or enabled access for ransomware groups including Rhysida, alongside Qilin, Interlock, Akira, 8Base, and Black Basta. Woodgnat has used compromised WordPress sites, ClickFix/FileFix/CrashFix lures, and Microsoft Teams helpdesk impersonation to obtain access. Rhysida operators have also been associated with use of SYSTEMBC, which Kroll says is favored by Rhysida operators and was deployed after access in at least one healthcare intrusion. Intel 471 also lists Rhysida among groups observed exploiting AnyDesk. The provided content highlights strong links between Rhysida and Interlock. IBM X-Force reported that both groups used the Supper backdoor, also known as SocksShell or WINDYTWIST, and found code and behavioral similarities across Supper, InterlockRAT, NodeSnake, JunkFiction, and ModeloRAT. Both groups were described as relying on trojanized software installers, fake Microsoft Teams download pages, traffic distribution systems, and ClickFix-style lures for initial access and payload delivery. IBM also noted post-compromise use of tools such as AZcopy, Advanced Port Scanner, and credential stealers. Another source in the content states the exact relationship between Interlock and Rhysida is unknown, while Cisco Talos previously assessed with low confidence that Interlock may have emerged from Rhysida operators or developers. Additional reporting in the content discusses a possible rebrand from Vice Society to Rhysida, but this is presented as analysis of a possible rebrand rather than a confirmed fact. The content also references Rhysida in broader ransomware ecosystem reporting, including use of traffic distribution services such as TAG-124 and mention in Microsoft reporting on Fox Tempest-enabled malware-signing activity.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

13 of 15 tactics44 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

5 techniques

T1078×5

Valid Accounts

T1133×3

External Remote Services

T1189×3

Drive-by Compromise

T1190×2

Exploit Public-Facing Application

T1566×4

Phishing

T1566.001

Spearphishing Attachment

TA0002

Execution

1 technique

T1059

Command and Scripting Interpreter

TA0003

Persistence

2 techniques

T1078×5

Valid Accounts

T1133×3

External Remote Services

TA0004

Privilege Escalation

2 techniques

T1068

Exploitation for Privilege Escalation

T1078×5

Valid Accounts

TA0005

Stealth

6 techniques

T1027×2

Obfuscated Files or Information

T1036×4

Masquerading

T1078×5

Valid Accounts

T1218

System Binary Proxy Execution

T1497

Virtualization/Sandbox Evasion

T1497.001×2

System Checks

T1620×2

Reflective Code Loading

TA0112

Defense Impairment

1 technique

T1553

Subvert Trust Controls

T1553.002×4

Code Signing

TA0006

Credential Access

1 technique

T1110

Brute Force

TA0007

Discovery

4 techniques

T1046

Network Service Discovery

T1082×2

System Information Discovery

T1083

File and Directory Discovery

T1497

Virtualization/Sandbox Evasion

T1497.001×2

System Checks

TA0008

Lateral Movement

2 techniques

T1021×2

Remote Services

T1021.001

Remote Desktop Protocol

T1210

Exploitation of Remote Services

TA0009

Collection

2 techniques

T1074×2

Data Staged

T1560

Archive Collected Data

TA0011

Command and Control

4 techniques

T1071×2

Application Layer Protocol

T1090

Proxy

T1090.003

Multi-hop Proxy

T1105×4

Ingress Tool Transfer

T1219×2

Remote Access Tools

TA0010

Exfiltration

4 techniques

T1041×7

Exfiltration Over C2 Channel

T1048

Exfiltration Over Alternative Protocol

T1537×2

Transfer Data to Cloud Account

T1567×5

Exfiltration Over Web Service

T1567.002

Exfiltration to Cloud Storage

TA0040

Impact

3 techniques

T1485

Data Destruction

T1486×20

Data Encrypted for Impact

T1657×6

Financial Theft

ARSENAL

Associated malware families

3 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

OysterThere’s an ongoing malicious ad campaign delivering a malware called OysterLoader, previously known as Broomstick and CleanUpLoader. The malware is an initial access tool (IAT) that gets onto devices to run a backdoor to gain access to the device and network.5Apr 15, 2026

RhysidaRhysida is a cybercriminal group that first surfaced in May 2023. Its ransomware can steal data and lock down targeted systems. It then demands a ransom both for deleting stolen data and for a key to restore infected devices. Rhysida operates a ransomware-as-a-service business in which affiliates pay Rhysida to use its malware and infrastructure to launch attacks and collect ransoms.3May 7, 2026

LatrodectusIn addition to OysterLoader, Expel discovered the Rhysida threat actors were also using Latrodectus malware in its campaign...2Mar 12, 2026

WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2020-1472Zerologon in Microsoft Netlogon Remote ProtocolIn the wildEvidence1

It has often made use of a privilege escalation vulnerability in the Microsoft NetLogon remote protocol in its attack chains – this flaw is known as Zerologon and is tracked as CVE-2020-1472.

IOCS

Observables

71 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

71 IOCsView more in app

hash.sha256

43 total

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••+35

uri

10 total

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••+2

Domains

9 total

••••••.com•••••••.ru••••••••.com•••••••••.net••••••••••.com•••••••••••.ru••••••••••••.com••••••.ru+1

ip.v4

9 total

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••+1

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

hackreadNews

Jun 26, 2026

Woodgnat Hackers Use Mistic RAT to Broker Access for Ransomware Gangs

Referenced as a downstream ransomware operation that may purchase access from Woodgnat.

security affairsNews

Jun 25, 2026

Inside Mistic, the New Stealth Backdoor in Ransomware Intrusions

Named as a ransomware crew that purchases or uses access brokered by KongTuke/Woodgnat.

Jun 25, 2026

Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs

Named as a ransomware crew previously linked to attacks involving KongTuke-provided access.

cyber security newsNews

Jun 24, 2026

Mistic Backdoor Blends With Microsoft Endpoint Security Tooling to Evade Detection

Referenced as one of the ransomware groups whose attacks have involved ModeloRAT.

+120 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping36

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal3

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables71

Domains, IPs, and hashes tied to this actor, refreshed continuously.