,

Attack Graph Response to CISA Advisory (AA23-319A): #StopRansomware: Rhysida Ransomware

Francis Guibernau
Andrew Costis

On November 15, 2023, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint Cybersecurity Advisory (CSA) disseminating known Rhysida ransomware Indicators of Compromise (IOCs) and Tactic, Technique and Procedures (TTPs) identified through investigations as recently as September 2023.

Rhysida is a Ransomware-as-a-Service (RaaS) that has been active since at least May 2023 and, despite being a newcomer, has quickly established itself as a significant fully-fledged ransomware operation. Rhysida has predominately been deployed against the Government, Manufacturing, and Technology sectors. However, more recently, it has expanded its activities to include Healthcare and Public Health organizations. As a result of this, in August 2023, the U.S. Department of Health and Human Services issued a warning to the healthcare industry about Rhysida ransomware activity.

AttackIQ have previously released two new attack graphs that seek to emulate the various activities carried out by this infamous Ransomware and its operators against multiple targets worldwide since its discovery in May 2023. For further coverage and details, we encourage you to check out the previous AttackIQ blog released on September 20, 2023.

AttackIQ stands at the ready to help security teams implement this attack graph and other aspects of the AttackIQ Security Optimization Platform, including through our fully managed service, AttackIQ Ready!, and our co-managed security service, AttackIQ Enterprise.

Francis Guibernau

Francis Guibernau is a Senior Adversary Research Engineer and member of the Adversary Research Team (ART) at AttackIQ. Francis conducts in-depth threat research and analysis to design and create highly sophisticated and realistic adversary emulations. He also coordinates the Cyber Threat Intelligence (CTI) project, which focuses on researching, analyzing, tracking, and documenting adversaries, malware families, and cybersecurity incidents. Francis has extensive experience in adversary intelligence, encompassing both Nation-State and eCrime threats, as well as in vulnerability assessment and management, having previously worked at Deloitte and BNP Paribas.

Andrew Costis

Andrew Costis (“AC”) is Chapter Lead of the Adversary Research Team at AttackIQ. He has over 22 years of professional industry experience, and previously worked in the Threat Analysis Unit (TAU) team at VMware Carbon Black, and LogRhythm Labs, performing security research, reverse engineering malware, tracking, and discovering new campaigns and threats. Andrew has delivered various talks at Def Con Adversary Village, Black Hat, B-Sides, CyberRisk Alliance, SecurityWeekly, ITPro, BrightTalk, SC Magazine and others.

Related Posts