Rhysida Ransomware: The Centipede Behind the British Library and Berlin Attacks

The Nisura Team · 8 September 2026

Rhysida is a ransomware-as-a-service group that has, in under three years, burned the British Library, leaked one of PlayStation’s most anticipated games, grounded parts of a major US airport, and dumped roughly 1.44 million files from the administration of a European capital. It takes its name — and its logo — from a genus of centipede. Behind the branding is an unglamorous, highly effective playbook: steal credentials, walk in through services that lack multi-factor authentication, exfiltrate everything, encrypt what’s left, and threaten to publish. This is a profile of how Rhysida operates, who it has hit, and why the risk it represents is exactly the kind Nisura is built to quantify.

Who Rhysida is

Rhysida first surfaced in May 2023, initially presenting itself — as several extortion crews do — as a “cybersecurity team” doing victims a favour by exposing their weaknesses. In reality it is a ransomware-as-a-service (RaaS) operation: the core group develops and maintains the ransomware and the leak-site infrastructure, and affiliates carry out intrusions in exchange for a share of any ransom. It targets, in CISA’s words, “targets of opportunity” across the education, healthcare, manufacturing, information technology and government sectors.

Rhysida did not appear from nowhere. US authorities and multiple researchers note strong overlaps between Rhysida activity and the earlier Vice Society gang (tracked by Microsoft as DEV-0832) — a crew notorious for hammering schools and hospitals. Vice Society’s leak-site activity fell quiet around the time Rhysida ramped up, and the two share a distinctive appetite for soft, essential-service targets. Treat the link as a well-supported association rather than a confirmed identity: the through-line is a preference for victims that can least afford downtime.

How they operate — the CISA-documented playbook

In November 2023, CISA, the FBI and the MS-ISAC published joint advisory AA23-319A (“#StopRansomware: Rhysida Ransomware”), since updated, which remains the authoritative technical reference. The chain it describes is deliberately ordinary:

• Initial access via credentials and remote access, not exotic exploits. Rhysida affiliates are “commonly observed authenticating to internal VPN access points with compromised valid credentials, notably due to organizations lacking MFA enabled by default.” Phishing and the Gootloader malware round out the entry vectors. There is no headline zero-day here — the front door is an unprotected login.
• Living off the land. Once inside, the group leans on built-in Windows tools and common utilities rather than bespoke malware: PsExec for lateral movement, ntdsutil and secretsdump to dump the NTDS.dit Active Directory database, PowerView for discovery, wevtutil to clear event logs, and remote-access tools like AnyDesk and the PortStarter backdoor for persistence. Later builds add AZCopy and Azure Storage Explorer to exfiltrate straight to attacker-controlled cloud storage.
• Encryption and the ransom note. The encryptor — a 64-bit Windows binary that identifies itself internally as “Rhysida-0.1” — encrypts files with a 4096-bit RSA key and the ChaCha20 stream cipher, appends the .rhysida extension, and drops a PDF ransom note titled “CriticalBreachDetected” directing victims to a Tor-based portal to negotiate in Bitcoin.
• Double extortion. Like most modern crews, Rhysida steals data before encrypting, then threatens to publish or auction it on its dark-web leak site if the ransom isn’t paid — often advertising stolen troves as “exclusive, unique, impressive” to a single buyer. Payment doesn’t un-leak what already left the network, which is why refusing the ransom, while correct, doesn’t undo the exposure.

Mapped to MITRE ATT&CK, the behaviour spans phishing (T1566) and valid accounts for initial access, command-and-scripting execution (T1059), registry-run-key persistence (T1547.001), process injection for privilege escalation (T1055), defence evasion through log-clearing and obfuscation, credential and directory discovery, exfiltration over its channel (T1041), and finally data encrypted for impact (T1486). None of it is individually novel — which is precisely the point.

The victim rap sheet

Rhysida’s targets read as a catalogue of essential services — libraries, hospitals, schools, transport authorities and governments — the organisations where downtime is most visible and the pressure to pay is highest:

We read these as claims and confirmed incidents, not as an endorsement of the attackers’ figures — leak-site totals are the group’s own numbers, and we reproduce none of the stolen data. For the full anatomy of the most recent case, see our deep dive on the Berlin ransomware attack, including an engine-derived estimate of what the incident actually cost.

The time Rhysida got beaten

Rhysida’s technical polish has limits. In early 2024, researchers — including a team at Kookmin University in South Korea working with the Korea Internet & Security Agency (KISA), and separately Avast — discovered a flaw in the ransomware’s encryption: a predictable pseudo-random number generator whose state could be reconstructed, allowing victims to recover their files without paying. It was one of the more significant public wins against an active RaaS operation.

The caveat, and the honest reading: Rhysida subsequently patched the weakness, so the decryptor does not work against current builds. It’s a genuine reminder that even a capable group ships exploitable mistakes — but it is not a recovery route you can count on today, and it doesn’t change the exfiltration-and-leak half of the extortion.

Why this is the risk Nisura is built to quantify

Strip away the centipede branding and Rhysida is a near-perfect illustration of the exposure the Nisura engine prices for every organisation:

• A credential and remote-access vector, not a CVE. The way in is a valid login against a service without MFA. Nisura models this non-CVE credential path as a first-class contributor to your annual breach likelihood — the scan-invisible route a CVE-only view of risk misses entirely.
• Downtime and recovery as the real number. The British Library’s multi-million, multi-year rebuild and Berlin’s weeks of outage are the true cost — not the ransom. Nisura’s output is an Expected Annual Loss in euros built from exactly those terms: downtime, business interruption, forensics and regulatory liability.
• EU regulatory liability, mapped. A healthcare provider, a transport authority or a public body hit by Rhysida faces NIS2 and GDPR exposure on top of the incident cost. Check whether the Directive binds you with the NIS2 Scope Checker, and watch the live picture on the EU Ransomware Tracker.

What defenders should take from the Rhysida advisory

CISA’s mitigations for Rhysida are, tellingly, the same fundamentals that blunt almost every RaaS crew — and they map directly to what NIS2 Article 21 expects:

• Require phishing-resistant MFA everywhere — especially on webmail, VPNs and any internet-facing login. This single control breaks Rhysida’s primary access path.
• Patch known-exploited vulnerabilities on internet-facing systems first, restrict and log PowerShell, and lock down RDP.
• Segment the network so a single compromised credential can’t reach the domain controller, and deploy EDR and monitoring to catch the living-off-the-land activity.
• Keep offline, encrypted, immutable backups — the only thing that shortens recovery once the encryptor runs, though it can’t un-leak exfiltrated data.

The uncomfortable through-line across every Rhysida victim, from the British Library to Berlin, is that none of it required a nation-state or a novel exploit — just a missing second factor and a soft internal network. That chain is measurable before it happens. Run the free CRQ simulation to see your own projected annual loss in euros from exactly these vectors, or compare Rhysida with the year’s most active crew in our profile of Qilin.

Sources & references

• CISA / FBI / MS-ISAC — #StopRansomware: Rhysida Ransomware (AA23-319A), the joint advisory on TTPs and mitigations.
• The Guardian — “Rhysida, the new ransomware gang behind British Library cyber-attack” and the British Library’s own “Learning Lessons from the Cyber-Attack” review.
• BBC News — “Insomniac: PlayStation studio ‘angered’ by ransomware hack” (the Marvel’s Wolverine leak).
• The Columbus Dispatch — Columbus data released on the dark web; The Seattle Times — Sea-Tac cyberattack attributed to Rhysida; The Baltimore Sun — ransomware attack on the Maryland DOT.
• Tripwire (Graham Cluley) — “Rhysida ransomware – what you need to know” (name, centipede logo, Vice Society link).
• CTI aggregation — the Rhysida group profile on ransomware.live (MITRE ATT&CK TTP mapping and tooling; leak-site activity tracked as the group’s own claims).

Figures attributed to Rhysida are the attackers’ own claims and vary by source; confirmed facts are sourced to CISA and mainstream reporting. We reproduce no leaked personal data, and we do not link to or facilitate access to any leak site. Nisura did not scan, probe, or access any victim systems for this article.