# MA-989.112023: MyCERT Alert - CISA, FBI, and MS-ISAC Release Advisory on Rhysida Ransomware

**Date:** 21 Nov 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-989.112023  
**Advisory ID:** MA-989.112023

---

**1.0 Introduction**
Recently, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint Cybersecurity Advisory (CSA), [#StopRansomware: Rhysida Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a), to disseminate known Rhysida ransomware indicators of compromise (IOCs), detection methods, and tactics, techniques, and procedures (TTPs) identified through investigations as recently as September 2023.
Observed as a ransomware-as-a-service (RaaS) model, Rhysida actors have compromised organizations in education, manufacturing, information technology, and government sectors and any ransom paid is split between the group and affiliates. Rhysida actors leverage external-facing remote services, such as virtual private networks (VPNs), Zerologon vulnerability ([CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472)), and phishing campaigns to gain initial access and persistence within a network.
**2.0 Impact**
Threat actors leveraging Rhysida ransomware are known to impact “targets of opportunity,” including victims in the education, healthcare, manufacturing, information technology, and government sectors. Open source reporting details similarities between Vice Society (DEV-0832)[[1](https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/)] activity and the actors observed deploying Rhysida ransomware. Additionally, open source reporting[[2](https://www.fortinet.com/blog/threat-research/ransomware-roundup-rhysida)] has confirmed observed instances of Rhysida actors operating in a ransomware-as-a-service (RaaS) capacity, where ransomware tools and infrastructure are leased out in a profit-sharing model. Any ransoms paid are then split between the group and the affiliates.
For additional information on Vice Society actors and associated activity, see the joint CSA [#StopRansomware: Vice Society](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a-0).
**3.0 Technical Details3.1 Tactics, Techniques and Procedures (TTPs)*3.1.1 Initial Access**
Rhysida actors have been observed leveraging external-facing remote services to initially access and persist within a network. Remote services, such as virtual private networks (VPNs), allow users to connect to internal enterprise network resources from external locations. Rhysida actors have commonly been observed authenticating to internal VPN access points with compromised valid credentials [[T1078](https://attack.mitre.org/versions/v14/techniques/T1078/)], notably due to organizations lacking MFA enabled by default. Additionally, actors have been observed exploiting Zerologon ([CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472))—a critical elevation of privileges vulnerability in Microsoft’s Netlogon Remote Protocol [[T1190](https://attack.mitre.org/versions/v14/techniques/T1190/)]—as well as conducting successful phishing attempts [[T1566](https://attack.mitre.org/versions/v14/techniques/T1566/)]. **Note:** Microsoft released a patch for CVE-2020-1472 on August 11, 2020.[[3](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1472)]
#### **3.1.2 Living off the Land**
Analysis identified Rhysida actors using living off the land techniques, such as creating Remote Desktop Protocol (RDP) connections for lateral movement [[T1021.001](https://attack.mitre.org/versions/v14/techniques/T1021/001/)], establishing VPN access, and utilizing PowerShell [[T1059.001](https://attack.mitre.org/versions/v14/techniques/T1059/001/)]. Living off the land techniques include using native (built into the operating system) network administration tools to perform operations. This allows the actors to evade detection by blending in with normal Windows systems and network activities.
Ipconfig [[T1016](https://attack.mitre.org/versions/v14/techniques/T1016/)], whoami [[T1033](https://attack.mitre.org/versions/v14/techniques/T1033/)], nltest [[T1482](https://attack.mitre.org/versions/v14/techniques/T1482/)], and several net commands have been used to enumerate victim environments and gather information about domains. In one instance of using compromised credentials, actors leveraged net commands within PowerShell to identify logged-in users and performed reconnaissance on network accounts within the victim environment. **Note:** The following commands were not performed in the exact order listed.
- net user [username] /domain [[T1087.002](https://attack.mitre.org/versions/v14/techniques/T1087/002/)]
- net group “domain computers” /domain [[T1018](https://attack.mitre.org/versions/v14/techniques/T1018/)]
- net group “domain admins” /domain [[T1069.002](https://attack.mitre.org/versions/v14/techniques/T1069/002/)]
- net localgroup administrators [[T1069.001](https://attack.mitre.org/versions/v14/techniques/T1069/001/)]
Analysis of the master file table (MFT)[[4](https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table)] identified the victim system generated the ntuser.dat registry hive, which was created when the compromised user logged in to the system for the first time. This was considered anomalous due to the baseline of normal activity for that particular user and system. **Note:** The [MFT](https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table) resides within the New Technology File System (NTFS) and houses information about a file including its size, time and date stamps, permissions, and data content.
**3.1.3 Leveraged Tools**
Table 1 lists legitimate tools Rhysida actors have repurposed for their operations. The legitimate tools listed in this joint CSA are all publicly available. Use of these tools should not be attributed as malicious without analytical evidence to support they are used at the direction of or controlled by threat actors.
**Disclaimer:** Organizations are encouraged to investigate and vet use of these tools prior to performing remediation actions.
| **Name** | **Description** | --- | --- | cmd.exe | The native command line prompt utility. | PowerShell.exe | A native command line tool used to start a Windows PowerShell session in a Command Prompt window. | PsExec.exe | A tool included in the PsTools suite used to execute processes remotely. Rhysida actors heavily leveraged this tool for lateral movement and remote execution. | mstsc.exe | A native tool that establishes an RDP connection to a host. | PuTTY.exe | Rhysida actors have been observed creating Secure Shell (SSH) PuTTy connections for lateral movement. In one example, analysis of PowerShell console host history for a compromised user account revealed Rhysida actors leveraged PuTTy to remotely connect to systems via SSH [[T1021.004](https://attack.mitre.org/versions/v14/techniques/T1021/004/)]. | PortStarter | A back door script written in Go that provides functionality for modifying firewall settings and opening ports to pre-configured command and control (C2) servers.[[1](https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/)] | secretsdump | A script used to extract credentials and other confidential information from a system. Rhysida actors have been observed using this for NTDS dumping [[T1003.003](https://attack.mitre.org/versions/v14/techniques/T1003/003/)] in various instances. | ntdsutil.exe | A standard Windows tool used to interact with the NTDS database. Rhysida actors used this tool to extract and dump the NTDS.dit database from the domain controller containing hashes for all Active Directory (AD) users.  **Note:** It is strongly recommended that organizations conduct domain-wide password resets and double Kerberos TGT password resets if any indication is found that the NTDS.dit file was compromised. | AnyDesk | A common software that can be maliciously used by threat actors to obtain remote access and maintain persistence [[T1219](https://attack.mitre.org/versions/v14/techniques/T1219/)]. AnyDesk also supports remote file transfer. | wevtutil.exe | A standard Windows Event Utility tool used to view event logs. Rhysida actors used this tool to clear a significant number of Windows event logs, including system, application, and security logs [[T1070.001](https://attack.mitre.org/versions/v14/techniques/T1070/001/)]. | PowerView | A PowerShell tool used to gain situational awareness of Windows domains. Review of PowerShell event logs identified Rhysida actors using this tool to conduct additional reconnaissance-based commands and harvest credentials. |
**3.2 Rhysida Ransomware Characteristics*3.2.1 Execution**
In one investigation, Rhysida actors created two folders in the C:\ drive labeled in and out, which served as a staging directory (central location) for hosting malicious executables. The in folder contained file names in accordance with host names on the victim’s network, likely imported through a scanning tool. The out folder contained various files listed in Table 2 below. Rhysida actors deployed these tools and scripts to assist system and network-wide encryption.
| **File Name** | **Hash (SHA256)** | **Description** | --- | --- | --- | conhost.exe | 6633fa85bb234a75927b23417313e51a4c155e12f71da3959e168851a600b010 | A ransomware binary. | psexec.exe | 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b | A file used to execute a process on a remote or local host. | S\_0.bat | 1c4978cd5d750a2985da9b58db137fc74d28422f1e087fd77642faa7efe7b597 | A batch script likely used to place 1.ps1 on victim systems for ransomware staging purposes [[T1059.003](https://attack.mitre.org/versions/v14/techniques/T1059/003/)]. | 1.ps1 | 4e34b9442f825a16d7f6557193426ae7a18899ed46d3b896f6e4357367276183 | Identifies an extension block list of files to encrypt and not encrypt. | S\_1.bat | 97766464d0f2f91b82b557ac656ab82e15cae7896b1d8c98632ca53c15cf06c4 | A batch script that copies conhost.exe (the encryption binary) on an imported list of host names within the C:\Windows\Temp directory of each system. | S\_2.bat | 918784e25bd24192ce4e999538be96898558660659e3c624a5f27857784cd7e1 | Executes conhost.exe on compromised victim systems, which encrypts and appends the extension of .Rhysida across the environment. |
Rhysida ransomware uses a Windows 64-bit Portable Executable (PE) or common object file format (COFF) compiled using MinGW via the GNU Compiler Collection (GCC), which supports various programming languages such as C, C++, and Go. The cryptographic ransomware application first injects the PE into running processes on the compromised system [[T1055.002](https://attack.mitre.org/versions/v14/techniques/T1055/002/)]. Additionally, third-party researchers identified evidence of Rhysida actors developing custom tools with program names set to “Rhysida-0.1” [[T1587](https://attack.mitre.org/versions/v14/techniques/T1587/)].
**3.2.2 Encryption**
After mapping the network, the ransomware encrypts data using a 4096-bit RSA encryption key with a ChaCha20 algorithm [[T1486](https://attack.mitre.org/versions/v14/techniques/T1486/)]. The algorithm features a 256-bit key, a 32-bit counter, and a 96-bit nonce along with a four-by-four matrix of 32-bit words in plain text. Registry modification commands [[T1112](https://attack.mitre.org/versions/v14/techniques/T1112/)] are not obfuscated, displayed as plain-text strings and executed via cmd.exe.
Rhysida’s encryptor runs a file to encrypt and modify all encrypted files to display a .rhysida extension.[[5](https://www.sentinelone.com/anthology/rhysida/)] Following encryption, a PowerShell command deletes the binary [[T1070.004](https://attack.mitre.org/versions/v14/techniques/T1070/004/)] from the network using a hidden command window [[T1564.003](https://attack.mitre.org/versions/v14/techniques/T1564/003/)]. The Rhysida encryptor allows arguments -d (select a directory) and -sr (file deletion), defined by the authors of the code as parseOptions.[[6](https://www.secplicity.org/2023/05/23/scratching-the-surface-of-rhysida-ransomware/)] After the lines of binary strings complete their tasks, they delete themselves through the control panel to evade detection.
**3.2.3 Data Extortion**
Rhysida actors reportedly engage in “double extortion” [[T1657](https://attack.mitre.org/versions/v14/techniques/T1657/)]—demanding a ransom payment to decrypt victim data and threatening to publish the sensitive exfiltrated data unless the ransom is paid.[[5](https://www.sentinelone.com/anthology/rhysida/)],[[7](https://blog.talosintelligence.com/rhysida-ransomware/)] Rhysida actors direct victims to send ransom payments in Bitcoin to cryptocurrency wallet addresses provided by the threat actors. As shown in Figure 1, Rhysida ransomware drops a ransom note named “CriticalBreachDetected” as a PDF file—the note provides each company with a unique code and instructions to contact the group via a Tor-based portal.
*Figure 1: Rhysida Ransom Note*
Identified in analysis and also listed in open source reporting, the contents of the ransom note are embedded as plain-text in the ransom binary, offering network defenders an opportunity to deploy string-based detection for alerting on evidence of the ransom note. Rhysida threat actors may target systems that do not use command-line operating systems. The format of the PDF ransom notes could indicate that Rhysida actors only target systems that are compatible with handling PDF documents.[[8](https://socradar.io/threat-profile-rhysida-ransomware/)]
**3.3 Indicators of Compromise (IOCs)**
On November 10, 2023, Sophos published TTPs and IOCs identified from analysis conducted for six separate incidents.[[9](https://news.sophos.com/en-us/2023/11/10/vice-society-and-rhysida-ransomware/)] The C2 IP addresses listed in Table 3 were derived directly from Sophos’ investigations and are listed on GitHub among other indicators.[[10](https://github.com/sophoslabs/IoCs/blob/master/2311%20Vice%20Society%20-%20Rhysida%20IoCs.csv)]
| **C2 IP Address** | --- | 5.39.222[.]67 | 5.255.99[.]59 | 51.77.102[.]106 | 108.62.118[.]136 | 108.62.141[.]161 | 146.70.104[.]249 | 156.96.62[.]58 | 157.154.194[.]6 |
Additional IOCs were obtained from FBI, CISA, and the MS-ISAC’s investigations and analysis. The email addresses listed in Table 4 are associated with Rhysida actors’ operations. Rhysida actors have been observed creating Onion Mail email accounts for services or victim communication, commonly in the format: [First Name][Last Name]@onionmail[.]org.
| **Email Address** | --- | rhysidaeverywhere@onionmail[.]org | rhysidaofficial@onionmail[.]org |
Rhysida actors have also been observed using the following files and executables listed in Table 5 to support their operations.
**Disclaimer:** Organizations are encouraged to investigate the use of these files for 
| **File Name** | **Hash (SHA256)** | --- | --- | Sock5.sh | 48f559e00c472d9ffe3965ab92c6d298f8fb3a3f0d6d203cd2069bfca4bf3a57 | PsExec64.exe | edfae1a69522f87b12c6dac3225d930e4848832e3c551ee1e7d31736bf4525ef | PsExec.exe | 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b | PsGetsid64.exe | 201d8e77ccc2575d910d47042a986480b1da28cf0033e7ee726ad9d45ccf4daa | PsGetsid.exe | a48ac157609888471bf8578fb8b2aef6b0068f7e0742fccf2e0e288b0b2cfdfb | PsInfo64.exe | de73b73eeb156f877de61f4a6975d06759292ed69f31aaf06c9811f3311e03e7 | PsInfo.exe | 951b1b5fd5cb13cde159cebc7c60465587e2061363d1d8847ab78b6c4fba7501 | PsLoggedon64.exe | fdadb6e15c52c41a31e3c22659dd490d5b616e017d1b1aa6070008ce09ed27ea | PsLoggedon.exe | d689cb1dbd2e4c06cd15e51a6871c406c595790ddcdcd7dc8d0401c7183720ef | PsService64.exe | 554f523914cdbaed8b17527170502199c185bd69a41c81102c50dbb0e5e5a78d | PsService.exe | d3a816fe5d545a80e4639b34b90d92d1039eb71ef59e6e81b3c0e043a45b751c | Eula.txt | 8329bcbadc7f81539a4969ca13f0be5b8eb7652b912324a1926fc9bfb6ec005a | psfile64.exe | be922312978a53c92a49fefd2c9f9cc098767b36f0e4d2e829d24725df65bc21 | psfile.exe | 4243dc8b991f5f8b3c0f233ca2110a1e03a1d716c3f51e88faf1d59b8242d329 | pskill64.exe | 7ba47558c99e18c2c6449be804b5e765c48d3a70ceaa04c1e0fae67ff1d7178d | pskill.exe | 5ef168f83b55d2cbd2426afc5e6fa8161270fa6a2a312831332dc472c95dfa42 | pslist64.exe | d3247f03dcd7b9335344ebba76a0b92370f32f1cb0e480c734da52db2bd8df60 | pslist.exe | ed05f5d462767b3986583188000143f0eb24f7d89605523a28950e72e6b9039a | psloglist64.exe | 5e55b4caf47a248a10abd009617684e969dbe5c448d087ee8178262aaab68636 | psloglist.exe | dcdb9bd39b6014434190a9949dedf633726fdb470e95cc47cdaa47c1964b969f | pspasswd64.exe | 8d950068f46a04e77ad6637c680cccf5d703a1828fbd6bdca513268af4f2170f | pspasswd.exe | 6ed5d50cf9d07db73eaa92c5405f6b1bf670028c602c605dfa7d4fcb80ef0801 | psping64.exe | d1f718d219930e57794bdadf9dda61406294b0759038cef282f7544b44b92285 | psping.exe | 355b4a82313074999bd8fa1332b1ed00034e63bd2a0d0367e2622f35d75cf140 | psshutdown64.exe | 4226738489c2a67852d51dbf96574f33e44e509bc265b950d495da79bb457400 | psshutdown.exe | 13fd3ad690c73cf0ad26c6716d4e9d1581b47c22fb7518b1d3bf9cfb8f9e9123 | pssuspend64.exe | 4bf8fbb7db583e1aacbf36c5f740d012c8321f221066cc68107031bd8b6bc1ee | pssuspend.exe | 95a922e178075fb771066db4ab1bd70c7016f794709d514ab1c7f11500f016cd | PSTools.zip | a9ca77dfe03ce15004157727bb43ba66f00ceb215362c9b3d199f000edaa8d61 | Pstools.chm | 2813b6c07d17d25670163e0f66453b42d2f157bf2e42007806ebc6bb9d114acc | psversion.txt | 8e43d1ddbd5c129055528a93f1e3fab0ecdf73a8a7ba9713dc4c3e216d7e5db4 | psexesvc.exe | This artifact is created when a user establishes a connection using psexec. It is removed after the connection is terminated, which is why there is no hash available for this executable. |
**4.0 Recommendations**
MyCERT recommends system administrators to review this advisory and take the below recommended mitigations to reduce the likelihood and impact of Rhysida and other ransomware incidents.
1. **Prioritize remediating known exploited vulnerabilities.**
2. **Enable multifactor authentication (MFA) for all services to the extent possible, particularly for webmail, VPN, and accounts that access critical systems.**
3. **Segment networks to prevent the spread of ransomware.**
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. [Microsoft: DEV-0832 (Vice Society) Opportunistic Ransomware Campaigns Impacting US Education Sector](https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/)
2. [FortiGuard Labs: Ransomware Roundup - Rhysida](https://www.fortinet.com/blog/threat-research/ransomware-roundup-rhysida)
3. [Microsoft: Security Update Guide - CVE-2020-1472](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1472)
4. [Microsoft: Master File Table (Local File Systems)](https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table)
5. [SentinelOne: Rhysida](https://www.sentinelone.com/anthology/rhysida/)
6. [Secplicity: Scratching the Surface of Rhysida Ransomware](https://www.secplicity.org/2023/05/23/scratching-the-surface-of-rhysida-ransomware/)
7. [Cisco Talos: What Cisco Talos Knows about the Rhysida Ransomware](https://blog.talosintelligence.com/rhysida-ransomware/)
8. [SOC Radar: Rhysida Ransomware Threat Profile](https://socradar.io/threat-profile-rhysida-ransomware/)
9. [Sophos: A Threat Cluster’s Switch from Vice Society to Rhysida](https://news.sophos.com/en-us/2023/11/10/vice-society-and-rhysida-ransomware/)
10. [Sophos: Vice Society - Rhysida IOCs (GitHub)](https://github.com/sophoslabs/IoCs/blob/master/2311%20Vice%20Society%20-%20Rhysida%20IoCs.csv)
11. [Check Point Research: Rhysida Ransomware - Activity and Ties to Vice Society](https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/)
12. [Microsoft: Command Line Process Auditing](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing)
13. [Microsoft: Audit Process Tracking](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-process-tracking)
14. [Microsoft: Remote Credential Guard](https://learn.microsoft.com/en-us/windows/security/identity-protection/remote-credential-guard?tabs=intune)
15. <https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a>