Classification: TLP:CLEAR | Publication Date: 2026-10-29 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

RHYSIDA Ransomware Gang: 4 New Leak-Site Listings — Financial, Professional Services & Energy Targeting Analysis with Detection Rules

Executive Summary

Dark web monitoring of the RHYSIDA ransomware gang's .onion leak site shows four new victim listings published between 2026-10-26 and 2026-10-29. The listings span Financial Services, Professional Services, and Energy & Utilities sectors across the United States, Belgium, and Malaysia.

The organizations RHYSIDA has listed or claims to have compromised are:

• ClaimTek Systems (Financial Services) — published 2026-10-29
• Noelker and Hull (Professional Services, US) — published 2026-10-28
• Machelen (Belgium) (BE) — published 2026-10-27
• MISC Group (Energy & Utilities, MY) — published 2026-10-26

These are criminal accusations, not confirmed breaches. RHYSIDA's posting cadence of roughly one listing per day over four consecutive days indicates an active campaign cycle. Organizations in the targeted sectors and geographies should treat this as a signal to review the detection content and hardening priorities below immediately — particularly around edge device patching, VPN/RDP exposure, and pre-encryption staging behaviors.

Sourcing & Verification

Three of the four listings above (ClaimTek Systems, Noelker and Hull, and Machelen (Belgium)) were independently observed by a second leak-site crawler, confirming that RHYSIDA did publish those claims. One listing — MISC Group — appears on ransomware.live only, with no second-crawler confirmation that the posting even exists; it should be treated with additional caution.

Critically, inclusion on a leak site reflects the threat actor's claim and is NOT confirmation of a breach. No corroboration tier in this dataset confirms that any intrusion occurred — only the named organization or its regulator can confirm that.

A named organization may dispute a listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question. We report these listings as threat-actor claims so defenders can prepare, not to adjudicate any individual case.

Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — RHYSIDA

Aliases & Attribution. RHYSIDA (also tracked by parts of the community under variants of the name, e.g., "Rhysida-0x") emerged in mid-2023 and is generally assessed as a closed or semi-closed ransomware operation rather than a broadly distributed Ransomware-as-a-Service (RaaS) platform. It has been publicly linked by government advisories (including a joint CISA/FBI/MS-ISAC advisory) to opportunistic attacks, with some overlap in tooling and technique with the broader Vice Society ecosystem historically observed.

Operating model. RHYSIDA operates a Tor-based leak site where it names victims, publishes proof-of-compromise samples, and runs timed auctions/countdowns for stolen data — a classic double-extortion model: encrypt (when possible) and threaten publication to force payment. Notably, some RHYSIDA-listed victims have reported data theft with little or no successful encryption, meaning the extortion leverage is often exfiltration-first.

Ransom demands. Demands are typically quoted in Bitcoin and scaled to the perceived ability to pay, historically ranging from the low hundreds of thousands of USD for small professional services firms to multi-million-dollar demands for larger enterprises. Public-sector and municipal entities have also featured among its historical claims.

Initial access methods (historically observed):

• Phishing with malicious attachments/links leading to loader deployment (macro execution, LNK/ISO payloads)
• Exploitation of internet-facing services, including VPN appliances and remote access gateways
• Valid account abuse, including RDP access via compromised credentials (often lacking MFA)
• Living-off-the-land post-compromise: RDP for lateral movement, PsExec/WMI for execution, Cobalt Strike for C2, and common exfiltration tools (e.g., Rclone/MEGA, FTP) before detonation

Dwell time. Reported dwell time for RHYSIDA intrusions is typically short-to-moderate — days to a few weeks — consistent with an opportunistic, move-fast operator rather than a long-dwell espionage actor. This compresses the defender's detection window and makes pre-encryption telemetry (staging, shadow copy deletion, mass file access) the highest-value alerting surface.

Current Campaign Analysis

Sectors Targeted

The four listings span Financial Services (ClaimTek Systems), Professional Services (Noelker and Hull), an unclassified entity (Machelen (Belgium)), and Energy & Utilities (MISC Group). This is consistent with RHYSIDA's historically opportunistic victimology — the gang does not concentrate on a single vertical but favors mid-market organizations with extortion-valuable data and limited mature security operations.

Geographic Concentration

Listings cover the United States, Belgium, and Malaysia — a geographically dispersed pattern with no single-region concentration. The Belgian listing (Machelen (Belgium)) follows RHYSIDA's known history of naming European public-sector-adjacent and municipal entities, while the Malaysian energy-sector claim (MISC Group) — which, again, is single-source and unverified — would represent critical-infrastructure interest if the claim is genuine.

Victim Profile

Based on the sectors involved, the claimed victim set skews toward small-to-mid-market organizations: professional services firms and financial services technology providers typically range from dozens to a few hundred employees with revenues in the low millions to low hundreds of millions USD. Larger energy-sector organizations, if a claim is genuine, would represent the upper bound of RHYSIDA's historical appetite. Mid-market organizations in these bands often lack 24/7 SOC coverage, MFA on all remote access, and current edge-device patching — the exact gaps this gang's known playbook exploits.

Posting Frequency & Escalation

Four listings in four consecutive days (2026-10-26 through 2026-10-29) is a compressed cadence for RHYSIDA, suggesting a batch of intrusions reaching the extortion phase simultaneously or a deliberate publication burst to maximize pressure. Security teams in the named sectors should assume parallel, undisclosed intrusions may be in progress elsewhere and hunt accordingly.

CVE Exposure — Hypothesis Only

We have no evidence linking any specific CVE to any named listing above. However, RHYSIDA's documented playbook of exploiting internet-facing infrastructure makes the following currently exploited vulnerabilities (all on the CISA Known Exploited Vulnerabilities catalog, all with confirmed ransomware use) the most probable sector-level exposure hypotheses for how intrusions of this type begin:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Network edge/VPN exploitation maps directly to RHYSIDA's known remote-access initial access vector. Added to KEV 2026-06-08.
• CVE-2026-20316 — Cisco Secure Firewall Management Center hard-coded password. Edge management-plane compromise provides both access and network visibility for lateral movement. Added to KEV 2026-07-29.
• CVE-2026-59310 — Broadcom VMware vCenter path traversal. Hypervisor management-plane access enables mass encryption of virtualized estates — the highest-impact detonation scenario. Added to KEV 2026-08-18.
• CVE-2026-63077 — JetBrains TeamCity deserialization. Build-server compromise offers both code-signing/credential access and a trusted lateral pivot. Added to KEV 2026-08-05.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-toolchain supply chain exposure, a less common RHYSIDA vector but relevant to professional services and technology firms. Added to KEV 2026-05-27.

If any of these products sit in your environment, treat patching as an emergency change, not a routine one.

Detection Engineering

The following detections target RHYSIDA's documented TTPs: phishing/macro initial execution, VPN/RDP-based access, PsExec/WMI lateral movement, Cobalt Strike-style C2, and pre-encryption staging (shadow copy deletion, mass file modification, archive creation for exfiltration).

---
title: RHYSIDA - Suspicious Office Macro Spawning Script or LOLBin Child Process
id: 8f3a2c10-7b1e-4f6a-9d2c-rhysida0001
status: experimental
description: Detects Microsoft Office processes spawning scripting interpreters or living-off-the-land binaries, consistent with RHYSIDA phishing/macro initial access chains.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/29
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\cmd.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-ins launching cmd; tune per environment
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1204.002
  - attack.t1059
---
title: RHYSIDA - PsExec or WMI Remote Service Execution for Lateral Movement
id: 8f3a2c10-7b1e-4f6a-9d2c-rhysida0002
status: experimental
description: Detects PsExec service installation and WmiPrvSE-spawned processes, both observed in RHYSIDA lateral movement tradecraft.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/29
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
    CommandLine|contains:
      - ' -s '
      - 'accepteula'
  selection_wmi:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative tooling; baseline admin PsExec/WMI usage and alert on deviations
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
  - attack.t1021.002
---
title: RHYSIDA - Pre-Encryption Staging - Shadow Copy Deletion and Backup Inhibition
id: 8f3a2c10-7b1e-4f6a-9d2c-rhysida0003
status: experimental
description: Detects Volume Shadow Copy deletion and backup catalog tampering, a near-universal RHYSIDA pre-encryption step and a high-fidelity last-chance alert before detonation.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/10/29
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'win32_shadowcopy'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wbdb:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: 1 of selection_*
falsepositives:
  - Legitimate backup maintenance scripts; rare in practice on endpoints
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

// RHYSIDA Hunt: Pre-ransomware staging and lateral movement chain
// Microsoft Sentinel — correlates RDP logons, PsExec-style service creation,
// shadow copy deletion, and mass file modification on the same host within 4h.
let Window = 4h;
let SuspiciousLogons =
    SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID == 4624 and LogonType in (3, 10)
    | where Account !endswith "$"
    | project LogonTime=TimeGenerated, Computer, Account, IpAddress;
let ServiceInstalls =
    SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID == 7045
    | where ServiceFileName has_any ("PSEXESVC", "\\ADMIN$\\", "cmd.exe", "powershell")
    | project ServiceTime=TimeGenerated, Computer, ServiceName, ServiceFileName;
let ShadowDelete =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete",
        "recoveryenabled no", "delete catalog", "win32_shadowcopy")
    | project ShadowTime=TimeGenerated, Computer=DeviceName, ProcessCommandLine, InitiatingProcessAccountName;
let MassFileMod =
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where ActionType == "FileRenamed"
    | summarize RenamedCount=count() by DeviceName, bin(TimeGenerated, 15m)
    | where RenamedCount > 500
    | project MassTime=TimeGenerated, Computer=DeviceName, RenamedCount;
SuspiciousLogons
| join kind=inner ServiceInstalls on Computer
| where ServiceTime between (LogonTime .. (LogonTime + Window))
| join kind=leftouter ShadowDelete on Computer
| where isnull(ShadowTime) or ShadowTime between (LogonTime .. (LogonTime + Window))
| join kind=leftouter MassFileMod on Computer
| project LogonTime, Computer, Account, IpAddress, ServiceName, ServiceFileName,
          ShadowTime, ProcessCommandLine, MassTime, RenamedCount
| order by LogonTime desc;

# RHYSIDA Rapid Triage Script — run on any suspected host or fleet-wide via your RMM/EDR
# Checks: exposed RDP, recent scheduled tasks, shadow copy status, suspicious services
Write-Host "=== RHYSIDA Rapid Triage — $(Get-Date) ===" -ForegroundColor Cyan

# 1. RDP exposure check
Write-Host "`n[1] RDP Configuration" -ForegroundColor Yellow
$rdp = Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) { Write-Host "  [!] RDP ENABLED — verify MFA/gateway restrictions" -ForegroundColor Red }
$nla = Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name UserAuthentication -ErrorAction SilentlyContinue
if ($nla.UserAuthentication -ne 1) { Write-Host "  [!] NLA DISABLED — brute force risk" -ForegroundColor Red }
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  ForEach-Object { Write-Host "  [!] Port 3389 LISTENING" -ForegroundColor Red }

# 2. Scheduled tasks created in last 7 days (persistence/staging)
Write-Host "`n[2] Scheduled Tasks Created/Modified Last 7 Days" -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-7) } |
  ForEach-Object { Write-Host "  - $($_.TaskName) | $($_.TaskPath)" -ForegroundColor Red }

# 3. Volume Shadow Copy status
Write-Host "`n[3] Volume Shadow Copies" -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "  [!] NO shadow copies present — may indicate deletion (T1490)" -ForegroundColor Red }
else { $shadows | ForEach-Object { Write-Host "  - $($_.ID) created $($_.InstallDate)" } }

# 4. Suspicious recently installed services (PsExec-style / unknown)
Write-Host "`n[4] Suspicious Services" -ForegroundColor Yellow
Get-CimInstance Win32_Service | Where-Object {
  $_.PathName -match 'PSEXESVC|ADMIN\$|\\Temp\\|\\Users\\Public\\|AppData.*\.exe'
} | ForEach-Object { Write-Host "  [!] $($_.Name): $($_.PathName)" -ForegroundColor Red }

# 5. Recent SMB admin-share writes (staging indicator)
Write-Host "`n[5] Recent Executable Drops in Public/Temp Locations (7 days)" -ForegroundColor Yellow
$paths = @("C:\Users\Public", "C:\Windows\Temp", "C:\ProgramData")
foreach ($p in $paths) {
  Get-ChildItem $p -Recurse -Include *.exe,*.dll,*.ps1,*.bat -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) } |
    ForEach-Object { Write-Host "  - $($_.FullName) ($($_.CreationTime))" -ForegroundColor Red }
}
Write-Host "`n=== Triage complete. Escalate any [!] finding to IR immediately. ===" -ForegroundColor Cyan

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

RHYSIDA's short dwell time means these signals, in order, are your last chances to intervene:

1. Shadow copy deletion / bcdedit tampering — the single highest-fidelity pre-detonation signal. Alert at CRITICAL severity, page the on-call IR team.
2. Mass file rename/modification bursts on any single host (>500 renames/15 min is a reasonable starting threshold).
3. New service installations (Event 7045) referencing PSEXESVC, ADMIN$ paths, or script interpreters — indicates active lateral spread.
4. Archive creation on servers — large .zip/.rar/.7z files written to staging directories, especially on file servers and database hosts, signal exfiltration prep (RHYSIDA's primary leverage).
5. Unusual outbound volume to cloud storage (MEGA, Rclone endpoints, unfamiliar S3 buckets) or FTP — exfiltration in progress; consider egress blocking even before full scoping.
6. Anomalous RDP/VPN logons from new geographies, at off-hours, or to servers that do not normally accept interactive sessions.

Critical Assets RHYSIDA Prioritizes for Exfiltration

Given the double-extortion model and this campaign's sector mix, prioritize monitoring and DLP coverage on:

• File shares containing client financial data, HR records, and PII (financial services / professional services claims)
• Email archives and document management systems (legal/financial correspondence is prime extortion material)
• Operational/engineering data for energy-sector environments (sensitive both for extortion and regulatory exposure)
• Backup infrastructure — RHYSIDA operators seek and destroy backups early; treat backup consoles as tier-zero assets

Containment Actions Ordered by Urgency

1. Isolate affected and adjacent hosts at the network layer (EDR network isolation or switch-level quarantine) — do not power off; memory holds key material and C2 artifacts.
2. Disable or force-reset the compromised accounts seen in logon telemetry; revoke VPN sessions enterprise-wide if edge compromise is suspected.
3. Block egress to identified exfil destinations at the proxy/firewall immediately.
4. Snapshot and preserve volatile evidence (memory, prefetch, USN journal, VSS state) before remediation.
5. Rotate all domain credentials (krbtgt twice, service accounts, local admin via LAPS) once lateral movement scope is established.
6. Engage legal/comms early — leak-site publication starts a clock on regulatory notification obligations regardless of encryption outcome.

Hardening Recommendations

Immediate (24 hours)

• Patch or mitigate the five KEV CVEs listed above if the products exist in your environment — especially Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), and VMware vCenter (CVE-2026-59310). If patching is not possible, remove the management interfaces from internet exposure today.
• Enforce MFA on all remote access — VPN, RDP gateways, and any externally reachable authentication portal. Credential-based RDP/VPN access without MFA is RHYSIDA's most reliable door.
• Disable Office macros from the internet (Mark of the Web blocking) via Group Policy if not already done.
• Deploy the Sigma rules above and verify shadow copy deletion (vssadmin/bcdedit) alerts page a human, not a queue.
• Audit scheduled tasks and services created in the last 7 days fleet-wide using the triage script above.

Short-Term (2 weeks)

• Segment backup infrastructure onto isolated networks with immutable/offline copies and dedicated, non-domain credentials. Assume the attacker will find domain-joined backups.
• Implement egress filtering and DLP on server VLANs; large outbound transfers to consumer cloud storage should be impossible by default.
• Restrict lateral movement paths: disable PsExec-style remote service creation where not operationally required, constrain WMI to admin subnets, and tier administrative accounts.
• Deploy decoy/canary files on high-value shares — access trips an immediate high-fidelity alert ahead of bulk exfiltration.
• Establish a leak-site monitoring and IR retainer capability so that if your organization ever appears in a listing like the ones above, the response clock starts the same hour, not after a journalist calls.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub