Rhysida Ransomware Hits Berlin Government Ahead of Elections: Detection, Hunting, and Hardening Guide

Berlin's state government confirmed this week that it is responding to an extortion attempt by the Rhysida ransomware group following an August cyberattack on the city-state's administrative network. The operators claim to have exfiltrated 5.79 terabytes of data from government systems, and officials have publicly refused to pay the ransom — a stance consistent with German federal policy and EU guidance, but one that now puts sensitive citizen and administrative data at risk of public leak.

The timing is not incidental. The intrusion surfaced weeks before Berlin's elections, which means the attackers have maximum leverage: government systems under operational stress, heightened media scrutiny, and political pressure to resolve the incident quietly. This is a deliberate pattern. Ransomware groups increasingly time disclosures against elections, fiscal year-ends, and regulatory deadlines to maximize extortion pressure.

For defenders, this incident is a live case study in Rhysida's operational playbook — a group that has consistently targeted government, education, healthcare, and critical infrastructure sectors since 2023 and remains one of the more active double-extortion operations tracked by CISA and the FBI. If your organization runs a Microsoft-centric enterprise with VPN concentrators, exposed RDP, or unmanaged service accounts, you are in Rhysida's target profile. The sections below give you concrete detection logic, hunt queries, and hardening steps grounded in this actor's documented tradecraft.

Technical Analysis: Rhysida's Kill Chain

Who Is Rhysida?

Rhysida operates as a ransomware-as-a-service (RaaS) operation conducting double-extortion attacks: encrypt victim systems, exfiltrate data first, and threaten publication on a Tor-hosted leak site if payment is refused. The group gained notoriety through attacks on the British Library, Insomniac Games (via Sony), Prospect Medical Holdings, and multiple municipal governments. CISA, the FBI, and MS-ISAC issued a joint advisory on Rhysida (AA23-319A) documenting its TTPs, and the group's operators have shown consistent reliance on living-off-the-land techniques rather than novel exploit development — which is good news for defenders, because LOTL behavior is detectable.

Initial Access

Rhysida affiliates most commonly gain entry through:

Phishing — credential-harvesting emails targeting privileged users
Valid accounts — compromised credentials, particularly for external-facing services (VPN, RDP) lacking MFA
Exposed remote services — RDP and VPN concentrators with weak or reused credentials

The Berlin attack vector has not been publicly confirmed, but the August-to-disclosure timeline is consistent with Rhysida's observed dwell time of weeks to months before detonation, during which they establish persistence, escalate privileges, and stage exfiltration.

Privilege Escalation and Persistence

Documented Rhysida behaviors include:

Kerberoasting (T1558.003) — requesting RC4-encrypted service tickets for accounts with SPNs to crack offline. This is one of Rhysida's signature moves and one of the highest-fidelity detection opportunities available to defenders.
Compromising valid domain accounts, often those with stale passwords or missing MFA
Creating or abusing local/domain admin accounts for persistence

Lateral Movement and Defense Evasion

RDP and SMB for lateral movement across the estate
PsExec-style remote service creation for execution on remote hosts
Deployment of PowerShell-based tooling for discovery and staging
Use of wevtutil and similar native tools to clear or manipulate event logs
Disabling or tampering with endpoint security products where privileges allow

Exfiltration and Impact

Data staged and exfiltrated — frequently using Rclone or similar legitimate sync tools renamed to blend in — to attacker-controlled infrastructure, often over port 443
The 5.79 TB claim in the Berlin case is significant: exfiltration of that volume is not stealthy if your egress monitoring is functioning. That volume implies sustained outbound transfer over days or weeks, which should have been visible in netflow, proxy logs, or firewall egress metrics.
Encryption follows exfiltration. Rhysida's encryptor has historically targeted Windows systems and VMware ESXi, appending a .rhysida extension and dropping ransom notes.

Exploitation Status

This is confirmed active exploitation in the wild — a live intrusion against a European capital's government, with claimed data theft and an active extortion demand. Rhysida remains an operational threat actor with a documented victim list spanning government, healthcare, and education sectors. No CVE is associated with this campaign; initial access relies on credential compromise and exposed services, which makes identity hygiene and MFA the primary control gaps.

Detection & Response

Sigma Rules

The following rules target Rhysida's documented behaviors: Kerberoasting, log clearing, mass shadow copy deletion, and Rclone-style exfiltration staging. These are high-signal detections that should not fire broadly in a well-managed environment.

YAML

---
title: Kerberoasting - Abnormal RC4 Service Ticket Requests
description: Detects potential Kerberoasting activity consistent with Rhysida tradecraft - multiple RC4-encrypted TGS requests for SPN accounts within a short window, indicating offline password cracking preparation.
references:
  - https://attack.mitre.org/techniques/T1558/003/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
author: Security Arsenal
date: 2026/01/15
status: experimental
tags:
  - attack.credential_access
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    TicketEncryptionType: '0x17'
    TicketOptions: '0x40810000'
  filter_legit_svc:
    ServiceName|startswith:
      - 'krbtgt'
      - '$'
  condition: selection and not filter_legit_svc
falsepositives:
  - Legacy applications legitimately requiring RC4 ticket encryption
  - Audit scanners performing authorized Kerberos enumeration
level: high
---
title: Security Event Log Cleared via wevtutil
description: Detects use of wevtutil to clear Windows event logs, a defense-evasion technique used by Rhysida operators to hinder forensic analysis before encryption deployment.
references:
  - https://attack.mitre.org/techniques/T1070/001/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
author: Security Arsenal
date: 2026/01/15
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - ' cl '
      - ' clear-log '
  condition: selection
falsepositives:
  - Rare - log clearing is not standard administrative practice outside of controlled maintenance
level: high
---
title: Rclone or Renamed Sync Tool Execution for Exfiltration
description: Detects execution of Rclone or renamed copies of cloud sync tools with config or copy/move flags consistent with ransomware staging and exfiltration, as used by Rhysida and peer groups.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
author: Security Arsenal
date: 2026/01/15
status: experimental
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\rclone.exe'
    - OriginalFileName: 'rclone.exe'
  selection_args:
    CommandLine|contains:
      - ' copy '
      - ' move '
      - ' sync '
      - '--config'
      - '--transfers'
  condition: all of selection_*
falsepositives:
  - Legitimate Rclone use by IT for cloud backup - baseline authorized deployments and alert on deviation
level: high

KQL Hunt — Microsoft Sentinel / Defender

This query hunts across the Rhysida kill chain: suspicious PowerShell execution, shadow copy deletion, log clearing, and high-volume egress patterns. Run it against both endpoint telemetry (DeviceProcessEvents) and ingested syslog/CEF from firewalls for exfiltration visibility.

KQL — Microsoft Sentinel / Defender

// Rhysida pre-encryption behavior hunt - endpoint + network
// Part 1: Destructive/pre-encryption commands on endpoints
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any (
    "vssadmin delete shadows",
    "vssadmin Delete Shadows",
    "bcdedit /set",
    "recoveryenabled no",
    "wevtutil cl",
    "wevtutil clear-log",
    "wbadmin delete catalog",
    "net stop ",
    "taskkill /f")
   or (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete")
   or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("-enc", "-e ", "FromBase64String", "DownloadString"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated desc;

// Part 2: High-volume egress to rare destinations (exfil signal for 5TB-scale theft)
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where ActionType == "ConnectionSuccess"
| where RemotePort in (443, 22, 21, 990)
| summarize TotalConnections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Processes = make_set(InitiatingProcessFileName) by DeviceName, RemoteIP, RemoteUrl
| where TotalConnections > 500
| order by TotalConnections desc;

// Part 3: Kerberoasting signal - burst of RC4 TGS requests (Windows Security events)
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4769
| where TicketEncryptionType == "0x17"
| where ServiceName !startswith "krbtgt" and ServiceName !has "$"
| summarize RequestCount = count(), DistinctSPNs = dcount(ServiceName), SPNList = make_set(ServiceName) by Account, IpAddress, bin(TimeGenerated, 1h)
| where RequestCount > 10 or DistinctSPNs > 5
| order by RequestCount desc

Tune Part 2 against your baseline — the threshold of 500 connections is a starting point for identifying sustained transfer sessions to single destinations, which is the network signature of multi-terabyte exfiltration.

Velociraptor VQL Hunt

For IR scoping on potentially compromised hosts — identifying encryption staging, renamed tooling, and suspicious service creation:

VQL — Velociraptor

-- Rhysida IR scoping: suspicious processes, ransom notes, and renamed sync tooling
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(vssadmin.*delete|bcdedit|wevtutil.*cl|wbadmin.*delete|rclone|--transfers|--config)'
   OR Exe =~ '(?i)(rclone|users\\public\\|programdata\\[a-z0-9]{6,12}\\)'

-- Hunt for ransom notes and encrypted file artifacts across user-writable paths
SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/Desktop/*.txt', 'C:/Users/Public/**/*.txt', 'C:/**/*.rhysida'])
WHERE FullPath =~ '(?i)(critical.*breach|readme|decrypt|\.rhysida$)'
   OR FullPath =~ '\.rhysida$'

-- Recently created services (PsExec-style remote execution artifacts)
SELECT Name, DisplayName, PathName, StartName, StartMode, State
FROM wmi_query(namespace='root/cimv2', query='SELECT Name, DisplayName, PathName, StartName, StartMode, State FROM Win32_Service')
WHERE PathName =~ '(?i)(\\\\.*\\admin\$|users\\public|temp\\|psexesvc|\\.exe -s)'

Hardening and Verification Script

This PowerShell script verifies the controls that break Rhysida's playbook: MFA-independent audit coverage, Kerberos hygiene (AES enforcement to blunt Kerberoasting), LAPS deployment, and RDP exposure checks. Run on a domain controller and adapt the LDAP filters to your environment.

PowerShell

# Rhysida-readiness verification - run elevated on a Domain Controller
# 1) Identify SPN accounts vulnerable to Kerberoasting (user accounts, RC4 allowed)
Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName,msDS-SupportedEncryptionTypes,PasswordLastSet,Enabled |
  Where-Object {$_.Enabled -eq $true} |
  Select-Object SamAccountName,PasswordLastSet,
    @{N='EncryptionTypes';E={$_.'msDS-SupportedEncryptionTypes'}},
    @{N='Kerberoastable';E={($_.'msDS-SupportedEncryptionTypes' -band 0x18) -eq 0}} |
  Format-Table -AutoSize

# 2) Enforce AES-only Kerberos on service accounts (mitigates Kerberoasting)
# Review output above first - legacy apps may break. Apply per-account after validation:
# Set-ADUser -Identity <svcAccount> -Replace @{'msDS-SupportedEncryptionTypes'=24}

# 3) Check for accounts with passwords older than 180 days (stale creds = Rhysida entry vector)
$cutoff = (Get-Date).AddDays(-180)
Get-ADUser -Filter {PasswordLastSet -lt $cutoff -and Enabled -eq $true} -Properties PasswordLastSet,AdminCount |
  Where-Object {$_.AdminCount -eq 1} |
  Select-Object SamAccountName,PasswordLastSet | Sort-Object PasswordLastSet

# 4) Verify LAPS is deployed (prevents lateral movement via shared local admin creds)
Get-ADComputer -Filter * -Properties ms-Mcs-AdmPwd,msLAPS-Password |
  Where-Object {-not $_.'ms-Mcs-AdmPwd' -and -not $_.'msLAPS-Password'} |
  Select-Object Name,@{N='LAPSStatus';E={'MISSING'}} | Measure-Object

# 5) Audit RDP exposure - check NLA requirement and non-standard port usage
Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' |
  Select-Object PortNumber,UserAuthentication,SecurityLayer

# 6) Confirm event log forwarding is active (log-clearing evasion defense)
Get-WinEvent -ListLog Security | Select-Object LogName,RecordCount,IsEnabled
wevtutil gl Security | Select-String -Pattern 'enabled'

# 7) Disable RC4 at the domain level via GPO recommendation check (audit current KDC config)
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Kdc' -Name 'SupportedEncryptionTypes' -ErrorAction SilentlyContinue

Remediation and Defensive Priorities

No vendor patch applies here — Rhysida's entry vector is identity and configuration failure, not a software vulnerability. Remediation is architectural:

MFA on every external-facing service, without exception. VPN concentrators, RDP gateways, OWA, and remote management portals. Rhysida's consistent initial access path is valid accounts without MFA. This is the single highest-impact control.
Kill RC4 Kerberos. Enforce AES-only ticket encryption on service accounts (script above). Kerberoasting only works against RC4-encrypted tickets; removing RC4 removes the technique's value. Review the CISA/FBI Rhysida advisory (AA23-319A) for the full IOC and mitigation set.
Segment and restrict lateral movement. RDP and SMB between workstations should be blocked by host firewall policy; admin protocols should flow only from designated privileged access workstations. Deploy LAPS so a single local admin credential compromise doesn't unlock the estate.
Egress monitoring with volume thresholds. 5.79 TB does not leave a network invisibly. Alert on sustained outbound transfers to rare destinations, new ASNs, and consumer cloud storage endpoints. Block known-abused sync tools (Rclone, MEGAsync) at the proxy unless explicitly authorized.
Protect and forward your logs. Rhysida operators clear event logs pre-encryption. Forward Security, System, and PowerShell logs to a SIEM in near-real-time so host-side tampering doesn't blind you.
Immutable, offline, tested backups. Berlin's refusal to pay is only a viable posture if restoration is possible. Test restoration of your most critical services quarterly — a backup you haven't restored is a hypothesis.
Pre-negotiate your ransom decision and IR retainer. Berlin's officials refused to pay, which aligns with German federal policy and reduces long-term extortion incentive — but that decision must be made before the incident, with legal counsel, executive leadership, and an IR partner at the table, not at 3 AM during detonation.

For organizations in government-adjacent sectors — municipalities, healthcare, education — treat this incident as a direct threat assessment input. Rhysida demonstrably targets your vertical, and election cycles and fiscal deadlines give them leverage windows.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub