Rhysida Active

rule Rhysida_ransomware_1 {
    meta:
        description = "Detects Rhysida ransomware"
        author = "RansomwareMonitor"
        date = "2026-03-06"
        hash = "18d5e778dac4f405d8971fa31bd6dead63dcc43d93a93c63f73f45fde9a002f9"

    strings:
        $h0 = { 9D DC 53 3E E0 1E D7 D2 32 62 EB 41 }
        $s1 = "Do not rename" nocase
        $r2 = /[13][a-km-zA-HJ-NP-Z1-9]{25,34}/
        $h3 = { 19 80 E0 DA 95 96 66 4E }

    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        4 of them
}

RHYSIDA

Dear Company,

This is an automated alert to inform you that your network has been compromised and
your data has been encrypted. We have also exfiltrated sensitive information from
your systems.

WHO ARE WE?
We are the Rhysida cybersecurity team. We believe that our pentest has highlighted
the significant vulnerabilities in your cybersecurity posture.

WHAT HAS HAPPENED?
Your critical data has been encrypted using military-grade algorithms.
Additionally, a significant volume of sensitive data has been extracted from your
network and is currently stored on our secure servers.

WHAT YOU NEED TO DO:
1. Do NOT attempt to decrypt the files on your own or with third-party tools.
2. Do NOT modify encrypted files.
3. Contact us within 72 hours via the following link (TOR required):
   http://rhysida[REDACTED].onion

We provide:
- Full data decryption
- Deletion of exfiltrated data from our servers
- A comprehensive security audit report

After 72 hours, the price doubles.
After 7 days, your data will be published.

Unique Key: {KEY}