RHYSIDA Ransomware Gang: 3 New US Victims in 48 Hours — Energy, Healthcare & Education Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-08-22 | Source: Dark web leak site monitoring via ransomware.live

Executive Summary

Security Arsenal's dark web monitoring infrastructure has confirmed 3 new victim postings to the RHYSIDA ransomware group's .onion leak site within a 48-hour window (2026-08-21 through 2026-08-22). All three victims are United States-based organizations spanning critical and soft-target sectors:

This clustering is consistent with RHYSIDA's historical victimology — opportunistic but deliberate concentration on under-resourced US critical infrastructure adjacent sectors. Energy utilities, healthcare providers, and K-12 districts should treat this as an active campaign indicator and immediately validate exposure against the initial access vectors detailed below.

Threat Actor Profile — RHYSIDA

Aliases / Attribution: RHYSIDA (self-styled). No confirmed rebrand lineage, though TTP overlap with Vice Society and occasional tooling reuse suggests shared affiliate ecosystem or broker relationships.

Operating Model: Closed-group / private operation rather than open RaaS. RHYSIDA does not publicly recruit affiliates on criminal forums at scale, which correlates with their moderate-but-steady posting cadence and tighter operational discipline compared to high-volume RaaS brands.

Ransom Demands: Typically in the low-to-mid six figures (USD) for SMB/local government victims, scaling into seven figures for larger healthcare and utility targets. Demands are calibrated to victim revenue — school districts and dental groups in this wave likely face demands in the $250K–$800K range based on historical comparables. RHYSIDA frequently prices in Bitcoin with a countdown timer on the leak site.

Initial Access Methods (observed across campaigns):

• Phishing with malicious attachments/links — primary vector, often delivering loaders that stage Cobalt Strike
• External remote services — exploitation of internet-facing VPN gateways and remote access software; the CISA KEV entry CVE-2026-50751 (Check Point Security Gateway improper authentication in IKEv1) is an active concern for this ecosystem, and CVE-2024-1708 (ConnectWise ScreenConnect path traversal) remains a favored ransomware initial access vector broadly
• Valid accounts harvested via infostealers or purchased from initial access brokers (IABs)
• Opportunistic use of exposed RDP with brute-forced or brokered credentials

Extortion Model: Double extortion — data is staged and exfiltrated before encryption; victims who refuse to pay are published to the leak site with proof packs. RHYSIDA is consistent about following through on publication threats, as this week's postings demonstrate.

Dwell Time: Historical telemetry suggests an average dwell time of 5–14 days from initial access to detonation, with faster cycles (48–72 hours) when access is purchased from brokers with pre-established persistence. This gives defenders a real, actionable detection window — the SIGMA and KQL content below targets exactly that window.

Tooling: Cobalt Strike, PsExec, WMI/WinRM for lateral movement, Rclone or similar for exfiltration to cloud storage, vssadmin delete shadows prior to encryption, and scheduled tasks for persistence.

Current Campaign Analysis

Sector Targeting

The current wave hits RHYSIDA's three most historically productive verticals simultaneously:

• Energy & Utilities (CRI Electric): Utility contractors and regional energy firms carry OT/IT adjacency risk and high pressure to restore service — a leverage point RHYSIDA exploits in negotiations.
• Healthcare (Fairview Dental Group): Small/mid-size healthcare remains the gang's bread and butter. PHI exfiltration creates regulatory (HIPAA) pressure on top of operational pressure.
• Education (Battle Creek Public Schools): K-12 districts are chronically under-resourced defensively, hold large volumes of minor's PII, and face public pressure around closures — a near-perfect extortion target profile.

Geographic Concentration

100% United States in this wave. RHYSIDA's victim base is overwhelmingly US-centric, consistent with their sector selection and ransom pricing model.

Victim Profile

All three victims fit the SMB-to-mid-market band: estimated revenues roughly $5M–$150M, employee counts in the tens-to-hundreds range. These are organizations large enough to pay meaningful ransoms but typically lacking 24/7 SOC coverage, mature EDR deployment, and tested offline backups. RHYSIDA deliberately hunts this gap.

Posting Frequency / Escalation

3 postings in ~48 hours is a notable cadence increase relative to RHYSIDA's baseline of roughly 1–2 victims per week. This pattern typically indicates one of two things: (1) a batch of access purchased from brokers detonated in parallel, or (2) a recently successful initial access campaign (e.g., a phishing wave or a newly exploited edge-vulnerability) maturing simultaneously. Defenders should assume more postings from this cluster are likely over the next 7–10 days.

CVE Correlation

The CISA KEV entries most relevant to this campaign window:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1): Edge-VPN auth bypass is a direct fit for RHYSIDA's external-remote-services initial access pattern. Any organization running Check Point gateways should treat patch status on this CVE as a P0 verification item today.
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE): Confirmed ransomware use. MSPs and SMBs with legacy ScreenConnect instances remain exposed; this is a classic RHYSIDA-ecosystem entry point into exactly the SMB victim profile seen here.
• CVE-2025-60710 (Windows link following → privilege escalation) and CVE-2023-21529 (Exchange deserialization): Post-access escalation and lateral movement enablers consistent with the gang's intrusion chain.
• CVE-2026-48027 (Nx Console supply chain): Developer-machine compromise vector; less directly tied to this victim set but relevant for orgs with engineering environments — a poisoned dev workstation is an excellent staging point for lateral movement into production.

Assessment: The victim clustering (three SMB US orgs detonating within 48 hours) is most consistent with either a brokered-access batch or exploitation of a common remote-access platform. CVE-2026-50751 and CVE-2024-1708 are the highest-probability technical entry points to rule out first.

Detection Engineering

The following detections target RHYSIDA's observed pre-encryption playbook: edge/VPN compromise, phishing-driven execution, PsExec/WMI lateral movement, shadow copy deletion, and data staging. Deploy the Sigma rules to your SIEM; run the KQL hunt in Sentinel; execute the PowerShell triage script on any host showing lateral movement indicators.

---
title: RHYSIDA - PsExec or WMI Remote Service Execution (Lateral Movement)
id: 7a3f1c2e-rhys-4a01-9b11-lateralpsexec01
status: production
description: Detects remote service creation and execution patterns consistent with RHYSIDA's use of PsExec and WMI for lateral movement prior to ransomware detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/22
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\paexec.exe'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
  selection_service_install:
    CommandLine|contains:
      - 'ADMIN$'
      - 'C$\'
      - 'svcctl'
  condition: selection_psexec or selection_wmi or (selection_service_install and selection_wmi)
falsepositives:
  - Legitimate administrative tooling (SCCM, PDQ, remote management platforms)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1047
---
title: RHYSIDA - Pre-Encryption Defense Evasion (Shadow Copy Deletion and Recovery Inhibition)
id: 8b4e2d3f-rhys-4b02-8c22-vssdelete001
status: production
description: Detects Volume Shadow Copy deletion, backup catalog deletion, and boot recovery disabling — hallmark RHYSIDA pre-encryption staging behavior executed minutes before detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/22
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith:
      - '\wmic.exe'
      - '\WMIC.exe'
    CommandLine|contains:
      - 'shadowcopy'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled'
      - 'bootstatuspolicy'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
  condition: 1 of selection_*
falsepositives:
  - Backup software maintenance (rare for vssadmin delete shadows on servers)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: RHYSIDA - Data Staging and Exfiltration Tooling (Rclone and Cloud Sync Abuse)
id: 9c5f3e4a-rhys-4c03-7d33-exfilstage01
status: production
description: Detects execution of Rclone and similar cloud exfiltration utilities commonly used by RHYSIDA to stage and exfiltrate victim data before encryption and leak site publication.
author: Security Arsenal Threat Intelligence
date: 2026/08/22
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\MEGAcmd.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
  selection_cli:
    CommandLine|contains:
      - 'rclone copy'
      - 'rclone move'
      - 'rclone sync'
      - '--config'
      - 'mega.nz'
      - 'dropbox.com'
  condition: selection_img or selection_cli
falsepositives:
  - Sanctioned cloud backup tooling (validate against approved software inventory)
level: high
tags:
  - attack.exfiltration
  - attack.t1567.002
  - attack.collection
  - attack.t1560

// RHYSIDA Pre-Ransomware Staging Hunt — Microsoft Sentinel
// Looks for correlated lateral movement + staging indicators on a single host
// within a 72-hour window (RHYSIDA fast-cycle dwell time)
let lookback = 7d;
let staging_window = 72h;
let SuspiciousRemoteExec =
    DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where ProcessCommandLine has_any ("ADMIN$", "PSEXESVC", "psexec", "wmic", "node ", "/node:")
       or InitiatingProcessParentFileName =~ "WmiPrvSE.exe"
    | project RemoteExecTime = TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
let StagingBehavior =
    DeviceProcessEvents
    | where TimeGenerated >= ago(lookback)
    | where ProcessCommandLine has_any (
        "delete shadows", "shadowcopy delete", "delete catalog",
        "recoveryenabled", "bootstatuspolicy",
        "rclone", "megacmd", " winscp", "7z.exe a", "rar.exe a"
      )
    | project StagingTime = TimeGenerated, DeviceName, StagingCmd = ProcessCommandLine, StagingFile = FileName;
SuspiciousRemoteExec
| join kind=inner StagingBehavior on DeviceName
| where StagingTime between (RemoteExecTime .. (RemoteExecTime + staging_window))
| summarize
    FirstRemoteExec = min(RemoteExecTime),
    FirstStaging = min(StagingTime),
    StagingCommands = make_set(StagingCmd, 10),
    RemoteAccounts = make_set(AccountName, 10)
    by DeviceName
| extend HoursBetween = datetime_diff("hour", FirstStaging, FirstRemoteExec)
| order by FirstStaging asc;

# RHYSIDA Rapid Triage Script — Run on any host flagged by the detections above
# Collects: new scheduled tasks (7d), shadow copy status, suspicious services,
# recent RDP logons, and edge-facing exposure indicators

$days = 7
$cutoff = (Get-Date).AddDays(-$days)
$report = @()

Write-Host "[1/5] Scheduled tasks created in last $days days..." -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff }
foreach ($t in $tasks) {
    $report += [PSCustomObject]@{ Category='NewScheduledTask'; Detail="$($t.TaskName) | $($t.TaskPath) | Created: $($t.Date)" }
}

Write-Host "[2/5] Volume Shadow Copy status (RHYSIDA deletes these pre-encryption)..." -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    $report += [PSCustomObject]@{ Category='ShadowCopies'; Detail='NONE FOUND - possible vssadmin deletion. HIGH ALERT.' }
} else {
    foreach ($s in $shadows) {
        $report += [PSCustomObject]@{ Category='ShadowCopies'; Detail="$($s.DeviceObject) created $($s.InstallDate)" }
    }
}

Write-Host "[3/5] Suspicious services (PsExec-style, random names)..." -ForegroundColor Cyan
$svcs = Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match '^(PSEXESVC|paexec|[a-z0-9]{6,8})$' -or
    ($_.PathName -match 'ADMIN\$|\\Temp\\|\\AppData\\' )
}
foreach ($s in $svcs) {
    $report += [PSCustomObject]@{ Category='SuspiciousService'; Detail="$($s.Name) | State: $($s.State) | Path: $($s.PathName)" }
}

Write-Host "[4/5] Recent RDP/network logons (Event 4624 Type 10/3, last $days days)..." -ForegroundColor Cyan
$rdp = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$cutoff} -MaxEvents 500 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+(10|3)' } |
    Select-Object -First 25
foreach ($e in $rdp) {
    $report += [PSCustomObject]@{ Category='NetworkLogon'; Detail="$($e.TimeCreated) | $($e.Message -split "`n" | Select-String 'Account Name|Source Network' | Out-String).Trim()" }
}

Write-Host "[5/5] Exfil tool artifacts on disk..." -ForegroundColor Cyan
$tools = @('rclone.exe','megacmd.exe','winscp.exe','filezilla.exe')
foreach ($tool in $tools) {
    $found = Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Temp' -Recurse -Filter $tool -ErrorAction SilentlyContinue -Depth 4
    foreach ($f in $found) {
        $report += [PSCustomObject]@{ Category='ExfilTool'; Detail="$($f.FullName) | Modified: $($f.LastWriteTime)" }
    }
}

$report | Format-Table -AutoSize -Wrap
$report | Export-Csv -Path ".\rhysida_triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
Write-Host "`nReport exported. If ShadowCopies=NONE or ExfilTool hits exist: ISOLATE HOST NOW." -ForegroundColor Red

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption Window)

RHYSIDA's 5–14 day dwell time is your opportunity. Escalate immediately if you see any two of the following on the same host or from the same account:

1. New scheduled tasks or services with random/short names, especially executing from %TEMP%, %APPDATA%, or ProgramData
2. PsExec-style service artifacts (PSEXESVC, ADMIN$ writes) or WMI-spawned shells (WmiPrvSE.exe → cmd.exe)
3. Cobalt Strike indicators: beaconing to low-reputation domains at fixed intervals, named pipes matching default CS profiles
4. Mass file read activity against file shares from a single workstation (staging behavior)
5. Rclone/cloud-sync processes on servers or finance/HR workstations
6. vssadmin, wbadmin, or bcdedit execution — treat as detonation imminent (minutes-to-hours); isolate the host and begin environment-wide containment immediately

Assets RHYSIDA Prioritizes for Exfiltration

Based on leak site proof packs across their history:

• Finance: accounting databases, bank details, wire/ACH records, tax documents
• HR/PII: employee SSNs, payroll, medical records (amplified value against healthcare victims like Fairview Dental — expect PHI/PII as the primary extortion lever)
• Student records for education victims (FERPA-protected data on minors — extremely high notification cost)
• Legal/contracts and insurance policies — RHYSIDA is known to read cyber-insurance policies to calibrate ransom demands
• Network documentation and credential dumps (used to threaten deeper reinfection)

Containment Actions (Ordered by Urgency)

1. Isolate affected hosts at the switch/EDR level — do NOT power off (preserve volatile evidence and avoid triggering dead-man's-switch encryption logic)
2. Disable compromised accounts and force enterprise-wide credential resets for any account that authenticated to a staging host; specifically reset VPN/local admin/service accounts
3. Block egress to consumer cloud storage (MEGA, Dropbox, personal OneDrive) and known exfil IPs at the proxy/firewall — cutting exfil mid-stream degrades their double-extortion leverage even if encryption fires
4. Segment backup infrastructure; verify offline/immutable backups are intact and out of reach before any recovery decision
5. Patch/verify edge devices — Check Point gateways (CVE-2026-50751) and any remote access software (ScreenConnect, CVE-2024-1708) are the doors most likely standing open
6. Engage IR counsel and determine notification obligations early — healthcare (HIPAA) and education (state breach laws, FERPA adjacency) victims in this wave face strict clocks once data is confirmed exfiltrated

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate Check Point Security Gateways against CVE-2026-50751; if patching is not possible today, disable IKEv1 where feasible and add gateway admin-interface ACLs
• Audit all remote access software (ScreenConnect, AnyDesk, TeamViewer, Splashtop) — remove unauthorized instances, patch authorized ones; block unauthorized RMM at the proxy
• Enforce MFA on all VPN and remote access with no legacy exceptions; phishing-resistant (FIDO2) preferred
• Block macro execution from internet-sourced Office documents (Mark-of-the-Web policies) — kills the most common RHYSIDA phishing chain
• Deploy the Sigma rules and KQL hunt above; baseline vssadmin/bcdedit usage so the critical rule fires clean
• Alert on Rclone and unsanctioned sync tools across servers and finance/HR endpoints

Short-Term (2 Weeks)

• Segment by function: isolate OT/SCADA-adjacent networks (energy victims), clinical systems (healthcare), and student data stores (education) from general user VLANs; ransomware that can't reach the crown jewels is a bad week, not a breach
• Deploy immutable/offline backups with a tested restore runbook; assume RHYSIDA operators will specifically hunt and delete your online backups
• EDR in block mode on all servers, not just endpoints — SMBs in this victim class frequently leave servers in audit mode
• Reduce dwell time surface: deploy the 72-hour correlation hunt (KQL above) as a scheduled analytic rule; RHYSIDA's fast-cycle intrusions are detectable if lateral movement and staging signals are correlated, not siloed
• Credential hygiene program: disable legacy authentication, tier administrative accounts, and rotate service account credentials — brokered valid accounts are a primary RHYSIDA entry vector
• Tabletop the double-extortion scenario: decide now, with legal and leadership, what your posture is if data is already exfiltrated when you detect the intrusion

This briefing is based on live dark web leak site monitoring. Victim postings do not independently confirm breach details; organizations named should be assumed to be in active negotiation or post-incident phases. Security Arsenal continues to monitor RHYSIDA's .onion infrastructure for additional postings from this campaign cluster.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub