Threat actor

Rhysida

TLP:CLEAR

Motivation: Financial
Malware and tools: AnyDesk, Impacket, PowerView, WinSCP
Techniques (MITRE ATT&CK): Abusing Elevation Control Mechanism: Bypass User Account Control, Phishing, Command and Scripting Interpreter, Shared Modules, Registry Run Keys / Startup Folder, Process Injection, Thread Execution Hijacking, Registry Run Keys, Obfuscated Files or Information, Masquerading, Virtualization/Sandbox Evasion, Hidden Artifacts
Last seen: 12 June 2026

Members get the actor's profile, its recent incidents and our assessment in the dashboard.

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX.