Rhysida
A ransomware-as-a-service operation active since May 2023 that targets education, healthcare and public bodies opportunistically. It claimed the British Library attack, and in September 2026 published data stolen from the State of Berlin.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The British Library is the clearest UK example. Its own review says the October 2023 attack was claimed by Rhysida, about 600GB of files were copied, and the Library paid no ransom. The first detected access was on a remote access server not covered by MFA. It calls the destruction of servers to inhibit recovery the most damaging element, as it had copies of its collections but lacked infrastructure to restore them.5
The method persists. In September 2026 the State of Berlin confirmed that stolen data had been published after it refused a demand of about €2m.3 Its chief digital officer said the state would not give in to blackmail.3
Who runs intrusions can differ from who builds the ransomware. CISA calls Rhysida a ransomware-as-a-service operation and notes open-source reports of similarities with Vice Society.2 Trade reporting describes Vanilla Tempest as also called Vice Society.4,1 Vice Society has also been seen deploying INC ransomware, so these names should not be treated as one group.6
The British Library's experience suggests testing whether you could rebuild, not only whether backups exist. Copies are of little use if there are no working systems to restore them to.
How It Attacks
Based on the 2023 FBI, CISA and MS-ISAC advisory2 and Microsoft's 2025 reporting on Vanilla Tempest.4,1 Specific operators may differ.
- 1
Get In
Logs into VPN access points with valid credentials, more easily without MFA, and runs phishing. Vanilla Tempest used fake Microsoft Teams installers, likely reached through SEO poisoning.
- 2
Escalate
Exploits CVE-2020-1472 and extracts credentials using tools such as secretsdump and ntdsutil.
- 3
Live Off the Land
Uses PowerShell, RDP, PsExec and native commands for discovery and movement, and clears event logs.
- 4
Hold On
Uses AnyDesk for access and the PortStarter backdoor. Vanilla Tempest used a signed Oyster backdoor.
- 5
Encrypt and Publish
Encrypts data and threatens publication, with ransom demands in Bitcoin. Data may be auctioned or posted.5
Key Techniques
ATT&CK v20 has no Rhysida entry. This mapping is ours, from behaviour in the joint advisory2 and in Microsoft's reporting.4
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1078 | Valid Accounts | Initial Access | Compromised VPN credentials. |
| T1566 | Phishing | Initial Access | Successful phishing campaigns. |
| T1608.006 | SEO Poisoning | Resource Development | Likely directs users to fake Teams downloads. |
| T1553.002 | Code Signing | Defense Impairment | Fraudulently signed installers and tools. |
| T1068 | Exploitation for Privilege Escalation | Privilege Escalation | CVE-2020-1472. |
| T1003.003 | NTDS | Credential Access | ntdsutil and secretsdump. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | mstsc.exe and other RDP use. |
| T1685.005 | Clear Windows Event Logs | Defense Impairment | wevtutil clears logs. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts victim data. |
| T1657 | Financial Theft | Impact | Demands Bitcoin and threatens publication. |
Tools Observed
Backdoors
Remote Access and Movement
Discovery and Credentials
Log Clearing
From the joint advisory2 and Microsoft's reporting on Oyster.4 Many are legitimate, so their presence alone is not proof.
Vulnerabilities
The joint advisory names one CVE.2 Credentials and social engineering are the main routes in these sources.
If this flaw is still open in your domain, treat it as urgent.
Key Events
Active from this month.2
British Library attack, later claimed by Rhysida.5
FBI, CISA and MS-ISAC publish a joint advisory.2
British Library publishes its incident review.8
Microsoft revokes more than 200 certificates used by Vanilla Tempest in fake Teams campaigns delivering Rhysida.4,1
Microsoft's Digital Crimes Unit and Resecurity take down the Fox Tempest signing service. Check Point names Rhysida, through Vanilla Tempest, as a customer.9
State of Berlin confirms stolen data was published after it refused to pay.3
Warning Signs
From the joint advisory2 and Microsoft's reporting.4 None of these proves an attack alone.
- Teams installers downloaded from lookalike domains
- VPN logins with valid credentials on accounts without MFA
- Event logs cleared with wevtutil
- ntdsutil activity or NTDS dumps on domain controllers
- AnyDesk or PuTTY on servers where they are not expected
Defences That Matter
Put MFA on All Remote Access
- Require phishing-resistant MFA for webmail, VPN and critical systems.2
- Include remote access servers. MFA gaps were a key factor at the British Library.5
Control Software Sources
- Allowlist approved remote access tools.2
- Deploy Teams and other common apps through managed channels and not search results.
Log and Watch
- Enable enhanced PowerShell logging, keep logs for 180 days and forward them to a hardened central server.2
- Monitor for abnormal and lateral traffic.2
Plan to Rebuild
- Keep offline, encrypted, immutable backups and test restoration.2
- Test whether you could rebuild infrastructure if servers were destroyed.5
- Replace legacy systems that slow recovery where you can.8
Could You Rebuild if Your Servers Were Destroyed?
We can test your recovery plans and access controls against the methods in this profile, and then help you close the gaps.
Sources
- The Hacker News: Microsoft Revokes 200 Fraudulent Certificates Used in Rhysida Ransomware Campaign, 17 October 2025
- FBI, CISA and MS-ISAC: #StopRansomware: Rhysida Ransomware, AA23-319A, 15 November 2023
- Infosecurity Magazine: Rhysida Publishes Berlin Government Data After €2m Extortion Demand Refused, 7 September 2026
- SecurityWeek: Microsoft Revokes Over 200 Certificates to Disrupt Ransomware Campaign, October 2025
- British Library: Learning Lessons from the Cyber-Attack, Cyber Incident Review, 8 March 2024
- Acronis TRU: From emerging threat to top-tier ransomware-as-a-service: the evolution of INC ransomware, 17 June 2026
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
- British Library: Learning lessons from the cyber-attack, blog post, 8 March 2024
- Check Point Research: The State of Ransomware Q2 2026, covering April to June 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.