What Cisco Talos knows about the Rhysida ransomware
Summary: Cisco Talos flagged the HHS advisory warning healthcare about Rhysida ransomware, which first appeared in May and has posted several high-profile compromises on its leak site. Rhysida encrypts files with the ChaCha20 algorithm across drives A: through Z:, renames them with a .rhysida extension, and drops a ransom note as CriticalBreachDetected.pdf and a wallpaper at C:/Users/Public/bg.jpg.
Key Takeaway: The group poses as a cybersecurity organization in its ransom note, offering to help victims resolve the very breach it caused, and it commonly deploys double extortion, with exfiltrated data from several leak-site victims already exposed.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·