Rhysida

A ransomware-as-a-service and double-extortion operation active since 2023. Its affiliates target education, healthcare, government, manufacturing, and other sectors using phishing, valid credentials, exposed services, and commodity tools before stealing data and encrypting Windows systems.