Threat-actor profile

← Back to main site

Home/ Threat Actors/ Rhysida

🌐Rhysida

🌐 Rhysida is a tracked threat actor in the Clankerusecase corpus. Attributed to ??. Primary motivation: Criminal. We map 9 detection use cases to this actor across 14 MITRE ATT&CK techniques, with 1 threat-intel article citing them. Active in our corpus from 2026-08-10 to 2026-08-10.

crit 1

View full actor card → All threat actors

9Use cases

1Articles

14Techniques

0IOCs

Known aliases

Rhysida

Top techniques

T1190 · Exploit Public-Facing Application T1195.002 · Compromise Software Supply Chain T1204.002 · Malicious File

All other tracked techniques

T1003 · OS Credential Dumping T1003.001 · LSASS Memory T1005 · Data from Local System T1021.002 · SMB/Windows Admin Shares T1071.001 · Web Protocols T1071.004 · DNS T1176 · Software Extensions T1486 · Data Encrypted for Impact T1539 · Steal Web Session Cookie T1555.003 · Credentials from Web Browsers T1569.002 · Service Execution

Detection use cases (9)

Beaconing — periodic outbound to small set of destinations Internal Suspicious browser extension installation Internal Infostealer — non-browser process accessing browser cookie/login DBs Internal Crypto-wallet file/keystore access by non-wallet process Internal Asset exposure — vulnerability matches article CVE(s) Internal Ransomware-style mass file rename / extension change Internal LSASS process access / dump (credential theft) Internal Remote service execution — PsExec / SMB lateral movement Internal Trusted vendor binary / installer launching unusual children Internal

Threat-intel articles (1)

crit IT threat evolution in Q2 2026. Non-mobile statistics · 2026-08-10

Tracked indicators

CVEs (3)

CVE-2026-33825 CVE-2026-50751 CVE-2026-50752