Rhysida is a sophisticated ransomware strain that emerged in mid-2023 and quickly gained notoriety for targeting critical infrastructure, healthcare organizations, and education sectors. Unlike commodity ransomware distributed through mass campaigns, Rhysida is deployed selectively by human operators who break into networks, spend time mapping your systems, and then encrypt everything at once for maximum impact. If you're reading this because files on your computer now have strange extensions and you're staring at a ransom note, you're dealing with one of the more aggressive threats currently active in the wild.
This ransomware operates as part of a Ransomware-as-a-Service (RaaS) model, meaning multiple criminal groups license the encryption tool from its developers. Rhysida attacks are typically preceded by network intrusion—your infection didn't start with a random email attachment; someone likely gained remote access to your network through compromised credentials, unpatched vulnerabilities, or poorly secured remote desktop services. The good news: if you've caught it early or maintained offline backups, recovery is possible. The bad news: Rhysida uses strong encryption and its operators have shown willingness to leak stolen data when ransoms aren't paid.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Name | Rhysida |
| Classification | Ransomware (RaaS / Human-operated) |
| Platform | Windows |
| File Type | Windows PE executable (typically 32-bit or 64-bit .exe) |
| First Observed | May 2023 |
| Encryption Method | ChaCha20 stream cipher with per-file keys (observed in sandbox analysis) |
| Typical File Extension | .rhysida (appended to encrypted files) |
| Ransom Note Filename | CriticalBreachDetected.pdf (dropped in affected directories) |
| Distribution Method | Manual deployment following network compromise; initial access via RDP brute-force, VPN exploits, or phishing for credentials |
| Data Exfiltration | Yes—operators steal sensitive data before encryption and threaten publication on Tor-based leak sites |
| Known Targets | Healthcare systems, educational institutions, municipal governments, critical infrastructure in North America and Europe |
| Detection Aliases | Ransom.Rhysida, Win32/Filecoder.Rhysida, Trojan-Ransom.Win32.Encoder (varies by antivirus vendor) |
How It Spreads
Rhysida does not spread like a worm or a virus—you won't get it from opening a single infected email attachment. Instead, it's delivered manually by attackers who have already gained a foothold in your network. The infection chain typically begins weeks or even months before the ransomware payload is deployed. Attackers use that time to escalate privileges, disable security software, delete backups, and identify high-value targets within your organization. This is why a Rhysida infection often feels like it comes out of nowhere: by the time you see the ransom note, the attackers have been inside your systems for a while.
Initial access is most commonly achieved through compromised Remote Desktop Protocol (RDP) services. Attackers scan the internet for machines with RDP exposed to the public, then use brute-force attacks or lists of stolen credentials purchased on criminal marketplaces. Once inside, they use tools like Mimikatz to harvest additional passwords, move laterally using Windows Management Instrumentation (WMI) or PsExec, and establish persistent backdoors. In some cases, attackers exploit known vulnerabilities in VPN appliances or use phishing emails designed to steal VPN credentials rather than deploy malware directly.
Common infection vectors include:
- Exposed RDP services with weak or default passwords, or credentials compromised in previous data breaches
- Unpatched VPN gateways (Fortinet, Cisco ASA, Pulse Secure) targeted with publicly available exploits
- Phishing campaigns aimed at stealing Active Directory or email credentials rather than delivering malware payloads
- Third-party vendor access through compromised managed service providers (MSPs) or software supply chain attacks
- Drive-by compromise of legitimate websites visited by employees, leading to credential theft or initial malware droppers
What It Does On Your Machine
Once the Rhysida executable is launched—usually through a scheduled task, Group Policy push, or remote PowerShell command—it begins by disabling Windows Defender and other security software using built-in tools like sc.exe and reg.exe. The ransomware then terminates processes associated with databases (SQL Server, MySQL), email servers (Exchange), backup software (Veeam, Acronis), and virtual machines (VMware, Hyper-V) to ensure those files can be encrypted without locks. Shadow Volume Copies—Windows' built-in backup mechanism—are deleted using vssadmin.exe to prevent easy recovery.
Encryption happens quickly. Rhysida uses the ChaCha20 stream cipher, which is fast and difficult to break without the corresponding decryption key. Each file is encrypted with a unique key, and those keys are themselves encrypted with a master public key held by the attackers. The ransomware typically skips certain system directories (like C:\Windows and C:\Program Files) to keep the operating system bootable—the attackers want you to be able to read their ransom note. After encryption, a PDF ransom note is dropped into every affected folder, along with a text file containing a unique victim ID and instructions for contacting the attackers via a Tor-based portal.
Rhysida also attempts to spread across network shares. If the compromised user account has access to mapped drives or UNC paths, the ransomware will encrypt files on those locations as well. This is why a single infected workstation can result in encrypted file servers, NAS devices, and shared folders across an entire organization. In observed incidents, attackers have also manually executed the ransomware on domain controllers and backup servers to maximize damage.
Manual Removal — Step by Step
Important: Manual removal will stop further encryption but will NOT decrypt your files. Rhysida uses strong encryption with keys held exclusively by the attackers. The steps below focus on eradicating the ransomware itself and preventing re-infection. For data recovery, you will need clean backups, professional forensic tools, or in rare cases where mistakes were made in the ransomware's implementation, third-party decryptors (none currently available for Rhysida at the time of writing).
Isolate the Infected System
Immediately disconnect the computer from all networks—unplug Ethernet cables and disable Wi-Fi. If the machine is part of a domain, notify your IT staff or an incident response professional before proceeding. Do NOT shut down the computer yet; memory forensics may reveal encryption keys or attacker commands. Take a photograph of any ransom note displayed on screen.
Boot into Safe Mode with Networking
Restart the computer and press F8 (or Shift + F8) during boot to access the Advanced Boot Options menu. Select "Safe Mode with Networking." This loads Windows with minimal drivers and prevents most malware—including Rhysida—from executing automatically. If you cannot boot normally, use a Windows installation USB to access the Recovery Environment.
Capture Evidence and Document IOCs
Before removing anything, document the infection. Check C:\ProgramData, C:\Users\Public, and your %TEMP% folder for executables with suspicious names. Note the exact filename and location. Open the ransom note and record the victim ID, contact instructions, and Tor URLs. This information will be needed if you involve law enforcement or negotiate with the attackers (not recommended without professional guidance).
Terminate Malicious Processes
Open Task Manager (Ctrl + Shift + Esc) and look for unfamiliar processes, especially those running from C:\ProgramData or user temp directories. Right-click suspicious entries and select "End Process Tree." Be cautious: Rhysida may use names that mimic legitimate Windows services. If uncertain, do NOT terminate critical system processes—consult a professional.
Remove Persistence Mechanisms
Press Win + R, type msconfig, and hit Enter. Go to the "Startup" tab (on Windows 10/11, this opens Task Manager's Startup tab). Disable any unfamiliar entries. Next, press Win + R, type regedit, and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Delete entries pointing to unknown executables, especially those in C:\ProgramData.
Delete Rhysida Executables and Artifacts
Using File Explorer, navigate to the locations identified in step 3. Delete the ransomware executable, ransom notes (PDFs and text files), and any supporting scripts or batch files. Check scheduled tasks by typing taskschd.msc in the Run dialog—delete any tasks created by the attackers (these often have random names or reference the malware executable).
Re-enable Security Software and Scan
Rhysida likely disabled Windows Defender. Press Win + I to open Settings, go to "Update & Security" > "Windows Security" > "Virus & threat protection," and turn Real-time protection back on. Run a full system scan. Also scan with a secondary tool like Malwarebytes or Emsisoft Emergency Kit. These scans will catch remnants or any secondary payloads left behind.
Check Network Shares and Other Machines
If the infected computer had access to network drives, those locations are likely encrypted too. Boot each machine on the network in Safe Mode and scan with updated antivirus software. Change passwords for all user accounts (especially administrator and service accounts) and review Active Directory logs for signs of lateral movement. Consider engaging a professional incident response team if multiple machines are affected.
Restore from Clean Backups
If you have backups that were not connected to the network during the attack, verify they are clean (scan them before restoring) and then restore your files. Do NOT restore system images or application binaries—only data files. Rebuild affected systems from scratch using fresh Windows installations to ensure no backdoors remain.
Monitor for Reinfection and Harden Security
After remediation, monitor network traffic and endpoint logs closely for at least 30 days. Attackers sometimes maintain secondary access points. Change all passwords, enable multi-factor authentication on RDP and VPN services, apply all available security patches, and segment your network to limit lateral movement. Consider a professional security audit.
Prevention
- Disable or secure RDP. If you must expose Remote Desktop to the internet, use a VPN and enforce multi-factor authentication. Better yet, disable RDP entirely on internet-facing machines and use zero-trust remote access tools.
- Implement offline backups. Follow the 3-2-1 rule: three copies of data, on two different media types, with one copy offline or offsite. Rhysida actively targets network-attached backups—ensure your critical backup drives are disconnected from the network when not in use.
- Patch everything religiously. Rhysida operators exploit known vulnerabilities in VPN appliances, web servers, and network devices. Subscribe to vendor security bulletins and apply patches within 48 hours of release for critical systems.
- Enforce least privilege. User accounts should NOT have administrative rights. Service accounts should have the minimum permissions necessary. Domain admin credentials should never be used for day-to-day tasks. This limits how far attackers can move laterally after initial compromise.
- Deploy endpoint detection and response (EDR). Free antivirus is insufficient against human-operated ransomware. EDR tools monitor process behavior, detect lateral movement, and can halt encryption before significant damage occurs. Even small businesses should consider managed EDR services.
- Use application whitelisting. Configure Windows to only allow execution of approved applications via AppLocker or Windows Defender Application Control. This prevents unauthorized executables from running, even if attackers gain access.
- Train users to recognize phishing. While Rhysida isn't delivered via email attachments, credential-stealing phishing is a common entry point. Conduct regular security awareness training and simulated phishing campaigns.
- Segment your network. Critical servers, workstations, and guest Wi-Fi should be on separate VLANs with firewall rules restricting cross-segment traffic. This makes lateral movement much harder for attackers.
Bring It In
Rhysida infections are serious incidents that require professional handling. If you're facing encrypted files, deleted backups, or suspect your network has been compromised, don't gamble with DIY solutions or online "decryptors" of dubious origin. Computer Repair Roswell has handled dozens of ransomware cases, from single-PC infections to multi-server outages. We offer same-day triage, forensic analysis to determine the scope of compromise, professional data recovery where backups exist, and most importantly, guidance on whether paying a ransom makes sense in your specific situation (spoiler: it usually doesn't, but we'll give you the facts).
Located at 1000 Alpharetta Street in Roswell, Georgia, we're open Monday through Saturday and offer both drop-off and on-site emergency services for business clients. Call us at (770) 681-0717 the moment you suspect an infection—the sooner we can preserve evidence and halt the encryption process, the more of your data we can save. Ransomware is scary, but it's not unbeatable, and you don't have to face it alone. Bring it in. We'll take it from here.