Berlin's city administration has publicly confirmed that cybercriminals are attempting to extort the city after the Rhysida ransomware group listed the municipality on its dark web data leak site. According to reporting by BleepingComputer, the group claims to have encrypted systems and stolen data — the group's signature double-extortion playbook — and is threatening to publish the exfiltrated material unless a ransom is paid.
This is not an isolated incident. Rhysida has aggressively targeted government and public-sector entities since emerging in 2023, with victims spanning municipal governments, healthcare systems, and education institutions across Europe and the United States. CISA and the FBI issued a joint advisory (AA23-319A) on Rhysida's TTPs, and the group has shown a consistent preference for soft targets with large data holdings, constrained security budgets, and high public pressure to restore services — a description that fits most city administrations.
For defenders, the Berlin incident is a forcing function. If your organization is a municipality, regional government, or public-sector adjacent entity, you should treat this as a live threat brief: Rhysida affiliates are actively running this playbook, their initial access vectors are well documented, and their post-exploitation behaviors are highly detectable with commodity telemetry. This post breaks down the attack chain, provides deployable detection content, and lays out concrete hardening steps.
Technical Analysis
Threat Actor Profile: Rhysida
Rhysida operates under a ransomware-as-a-service (RaaS) model and runs a Tor-based data leak site where victims are named and given deadlines before stolen data is published or auctioned. The group has historically offered victims the option to buy their data back exclusively, with a countdown timer — a pressure tactic now being applied to Berlin.
Documented Attack Chain (per CISA/FBI AA23-319A and incident reporting)
Rhysida intrusions follow a repeatable pattern that defenders can map directly to detections:
- Initial access: Spear phishing and — notably — exploitation of exposed services. Rhysida affiliates have a documented history of leveraging valid accounts, including compromised VPN credentials lacking MFA, and have been observed using the Zerologon vulnerability (CVE-2020-1472) in legacy environments. External-facing RDP and VPN appliances remain prime entry points for government networks with aging perimeter infrastructure.
- Execution and staging: Cobalt Strike beacons and PsExec are core tooling. PowerShell is used heavily for discovery, staging, and lateral movement.
- Persistence and lateral movement: Creation of local accounts, modification of the
Remote Desktop Usersgroup, and RDP-based pivoting across the flat networks typical of municipal IT environments. PsExec-driven service creation on remote hosts is a hallmark. - Defense evasion: Termination of antivirus and backup agents, deletion of Volume Shadow Copies via
vssadminandwmic, and log clearing (wevtutil) before encryption. - Impact and extortion: Deployment of the Rhysida encryptor (a ChaCha20-based payload), dropping of ransom notes, and parallel exfiltration — often via Rclone to cloud storage — before encryption is triggered. The leak-site listing confirms the exfiltration phase completed against Berlin before or alongside encryption.
Exploitation Status
Rhysida is a confirmed, actively operating ransomware group with ongoing campaigns as of 2026. The Berlin listing demonstrates the group is actively compromising and extorting large government entities right now. No specific CVE is cited in the Berlin reporting, and none is referenced in the source summary; the threat here is the group's end-to-end intrusion methodology, which is fully observable with standard EDR, Windows event logging, and network telemetry.
Detection & Response
The detections below target Rhysida's documented post-compromise behaviors: shadow copy deletion, log clearing, RDP-based lateral movement with local account manipulation, PsExec service creation, and Rclone-style exfiltration. These are tuned to fire on behavior, not commodity noise.
---
title: Rhysida Ransomware Shadow Copy Deletion
description: Detects deletion of Volume Shadow Copies via vssadmin, wmic, bcdedit, or PowerShell — a documented Rhysida pre-encryption anti-recovery behavior.
references:
- https://attack.mitre.org/techniques/T1490/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\vssadmin.exe'
- '\wmic.exe'
- '\bcdedit.exe'
- '\powershell.exe'
- '\pwsh.exe'
selection_cmd:
CommandLine|contains:
- 'delete shadows'
- 'shadowcopy delete'
- 'resize shadowstorage'
- 'recoveryenabled no'
- 'Delete-WmiObject'
- 'Get-WmiObject Win32_Shadowcopy'
condition: selection_img and selection_cmd
falsepositives:
- Rare legitimate storage administration; investigate host context immediately regardless
level: high
---
title: Rhysida Pre-Encryption Windows Event Log Clearing
description: Detects bulk clearing of Windows event logs via wevtutil or PowerShell Clear-EventLog, consistent with Rhysida defense-evasion activity prior to ransomware deployment.
references:
- https://attack.mitre.org/techniques/T1070.001/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- 'wevtutil cl'
- 'wevtutil.exe cl'
- 'Clear-EventLog'
- 'Remove-EventLog'
falsepositives:
- Log rotation scripts in some environments; validate against change records
level: high
---
title: Rhysida Local Account Creation and RDP Enablement
description: Detects creation of local accounts combined with addition to Remote Desktop Users or Administrators groups — a Rhysida persistence and lateral movement pattern.
references:
- https://attack.mitre.org/techniques/T1136.001/
- https://attack.mitre.org/techniques/T1098/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
author: Security Arsenal
date: 2026/04/06
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection_create:
CommandLine|contains:
- 'net user'
- 'net.exe user'
- 'New-LocalUser'
CommandLine|contains:
- ' /add'
- 'New-LocalUser'
selection_group:
CommandLine|contains:
- 'Remote Desktop Users'
- 'administrators'
- 'Administratoren'
- 'Remotedesktopbenutzer'
condition: selection_create and selection_group
falsepositives:
- IT provisioning scripts; correlate with ticketing systems and execution time
level: high
// Hunt: Rhysida-style pre-encryption defense evasion and lateral movement
// Covers shadow copy deletion, log clearing, Rclone exfiltration staging, and PsExec service execution
let lookback = 7d;
let AntiRecovery = dynamic(['delete shadows', 'shadowcopy delete', 'resize shadowstorage', 'recoveryenabled no']);
let LogClear = dynamic(['wevtutil cl', 'Clear-EventLog', 'Remove-EventLog']);
let Exfil = dynamic(['rclone', 'mega.io', 'mega.nz', 'transfer.sh']);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where ProcessCommandLine has_any (AntiRecovery, LogClear, Exfil)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
),
(DeviceEvents
| where TimeGenerated >= ago(lookback)
| where ActionType == 'ServiceInstalled'
| where AdditionalFields has 'psexesvc' or FileName =~ 'PSEXESVC.exe'
| project TimeGenerated, DeviceName, ActionType, FileName, AdditionalFields, InitiatingProcessAccountName
)
| order by TimeGenerated asc
-- Velociraptor hunt: Rhysida staging artifacts and suspicious execution
-- Looks for PsExec service binaries, Rclone, and encryptor-adjacent tooling across the fleet
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)psexesvc|rclone'
OR CommandLine =~ '(?i)(delete shadows|shadowcopy delete|wevtutil cl|rclone (copy|move|sync))'
OR Exe =~ '(?i)\\\\users\\\\[^\\\\]+\\\\(appdata|downloads|programdata)\\\\[^\\\\]*\\.exe$'
# Rhysida pre-encryption indicator sweep — run fleet-wide via your EDR/WinRM/Intune
# Checks for recent shadow copy deletion, cleared logs, rogue local admins, and staging artifacts
Write-Host '=== Shadow copy status (should list copies; empty = deleted) ===' -ForegroundColor Cyan
vssadmin list shadows
Write-Host '`n=== Local accounts created in the last 14 days ===' -ForegroundColor Cyan
Get-LocalUser | Where-Object { $_.Enabled -and (Get-Date) - $_.PasswordLastSet -lt (New-TimeSpan -Days 14) } |
Select-Object Name, Enabled, PasswordLastSet
Write-Host '`n=== Members of local Administrators and Remote Desktop Users ===' -ForegroundColor Cyan
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name, ObjectClass
Get-LocalGroupMember -Group 'Remote Desktop Users' -ErrorAction SilentlyContinue | Select-Object Name, ObjectClass
Write-Host '`n=== Suspicious services (PsExec-style) ===' -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'ADMIN\$|PSEXESVC' } |
Select-Object Name, State, PathName, StartName
Write-Host '`n=== Staging artifacts in writable directories ===' -ForegroundColor Cyan
Get-ChildItem -Path 'C:\ProgramData','C:\Users\*\AppData\Local\Temp','C:\Users\Public' -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match 'rclone|\.onion|readme.*impact|critical.*alert' } |
Select-Object FullName, Length, LastWriteTime
Write-Host '`n=== Security log cleared recently? (Event 1102) ===' -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
Select-Object TimeCreated, Id, Message
Remediation and Hardening
If You Are Under Active Attack or Suspect Compromise
- Isolate, do not reboot. Segmented network isolation of affected subnets preserves volatile evidence. Powering down hosts destroys memory-resident indicators needed for scoping exfiltration.
- Assume exfiltration. Rhysida's model means encryption is the second event — data theft precedes it. Begin scoping outbound transfer volume (egress to cloud storage, unusual GB-scale transfers off-hours) immediately, since breach notification obligations under GDPR (Berlin is a German federal state — strict timelines apply) hinge on what data left the network.
- Reset credentials in the correct order. KRBTGT twice, then all privileged accounts, then service accounts — Rhysida's use of valid accounts and Kerberos abuse means partial resets leave doors open.
- Engage the national authorities. For German entities: BSI and the relevant state data protection authority. For US entities: CISA, FBI, and your state fusion center. Rhysida has an active CISA advisory with IOCs and TTP mappings.
Proactive Hardening — Priority Actions for Public-Sector Defenders
- Enforce MFA on all remote access, no exceptions. Rhysida's documented initial access via VPN accounts without MFA remains the single highest-leverage fix. Phishing-resistant MFA (FIDO2) for administrative access.
- Kill or constrain RDP. No internet-exposed RDP, period. Internally, restrict RDP via host firewall rules and tiered administration; alert on any new
Remote Desktop Usersgroup membership. - Protect recovery mechanisms. Restrict
vssadmin/bcdeditexecution via application control (WDAC/AppLocker), enable immutable/offline backups, and test restoration. Rhysida victims that recovered without paying did so on the strength of backups the encryptor could not reach. - Segment municipal networks. Flat networks are why city ransomware incidents cascade from tax offices to utilities. VLAN-level segmentation with east-west inspection limits blast radius.
- Monitor egress. Rclone and similar exfiltration tooling is detectable at the proxy and DNS layer. Alert on unsanctioned cloud storage destinations and on off-hours transfer volume anomalies.
- Patch legacy domain controllers. Rhysida's historical use of Zerologon (CVE-2020-1472) against unpatched DCs is a reminder: municipal environments still run end-of-life infrastructure. Enforce Netlogon secure RPC and remediate anything unpatchable by isolation.
- Deploy the detections above and validate them. Run purple-team emulation of the shadow-copy deletion and log-clearing behaviors to confirm your pipeline actually alerts — many organizations discover collection gaps only during a real intrusion.
The Berlin incident will follow the familiar arc: leak-site pressure, a deadline, possibly partial data publication. The lesson for every other city and public agency is that Rhysida's playbook is known, its behaviors are noisy, and the organizations that fare best are those that instrumented for exactly these TTPs before the ransom note arrived.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.