Rhysida ransomware

Rhysida is a double-extortion ransomware operation active since May 2023. Encrypted files end in .rhysida, and the ransom note is a PDF named CriticalBreachDetected.pdf written in the voice of a fake cybersecurity team Rhysida. It claims data has been exfiltrated, supplies a per-victim key, and directs the victim to a Tor portal or to Onion Mail addresses. Operators often get in with valid credentials on VPNs lacking multi-factor authentication, phishing, or the Zerologon flaw, then move with RDP and PowerShell and hit education, healthcare, manufacturing, IT and government targets; Linux and ESXi builds also exist. Stolen data is auctioned on a leak site, and the activity is tied to the cluster that earlier ran Vice Society. Avast publishes a free Rhysida decryptor, listed on No More Ransom, that exploits a key-generation weakness in early Windows builds; it must run on the same machine that was encrypted, and builds from June 2024 onward, which fixed the weakness, are reported not to be covered.

File extensions: .rhysida

Ransom note filenames: CriticalBreachDetected.pdf

Decryptor: A decryptor exists but covers only some builds. Checked 2026-10-28.

Data exfiltration risk: Confirmed — Federal #StopRansomware reporting describes double extortion with publication of exfiltrated data, and stolen data is auctioned on the Rhysida leak site.

Systems typically targeted: Windows hosts, Linux servers, VMware ESXi hosts

Do this first: Keep encrypted Windows machines powered and untouched, with drive letters unchanged, so the public Rhysida decryptor can be tested on the same machine before any reimaging.

Sources: No More Ransom