Attack Graph Response to CISA Advisory (AA23-319A): #StopRansomware: Rhysida Ransomware

Francis Guibernau
Andrew Costis

On November 15, 2023, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint Cybersecurity Advisory (CSA) disseminating known Rhysida ransomware Indicators of Compromise (IOCs) and Tactic, Technique and Procedures (TTPs) identified through investigations as recently as September 2023.

Rhysida is a Ransomware-as-a-Service (RaaS) that has been active since at least May 2023 and, despite being a newcomer, has quickly established itself as a significant fully-fledged ransomware operation. Rhysida has predominately been deployed against the Government, Manufacturing, and Technology sectors. However, more recently, it has expanded its activities to include Healthcare and Public Health organizations. As a result of this, in August 2023, the U.S. Department of Health and Human Services issued a warning to the healthcare industry about Rhysida ransomware activity.

AttackIQ have previously released two new attack graphs that seek to emulate the various activities carried out by this infamous Ransomware and its operators against multiple targets worldwide since its discovery in May 2023. For further coverage and details, we encourage you to check out the previous AttackIQ blog released on September 20, 2023.

AttackIQ stands at the ready to help security teams implement this attack graph and other aspects of the AttackIQ Security Optimization Platform, including through our fully managed service, AttackIQ Ready!, and our co-managed security service, AttackIQ Enterprise.

Francis Guibernau

Francis conducts in-depth threat research and analysis to design and create highly sophisticated and realistic adversary emulations. He also coordinates the CTI project, which focuses on researching, analyzing, tracking, and documenting adversaries, malware families, and cybersecurity incidents. Francis has extensive experience in adversary intelligence, encompassing both Nation-State and eCrime threats, as well as in vulnerability assessment and management, having previously worked at Deloitte and BNP Paribas.

Andrew Costis

Andrew Costis (“AC”) is the Engineering Manager of the Adversary Research Team at AttackIQ, with more than 24 years of tech and cybersecurity experience. Previously, he conducted security research and threat analysis with VMware Carbon Black’s Threat Analysis Unit (TAU) and LogRhythm Labs, specializing in malware reverse engineering, threat tracking, and the discovery of emerging campaigns. Andrew has presented at industry events including DEF CON Adversary Village, Black Hat, BSides, CyberRisk Alliance, Security Weekly, ITPro, BrightTALK, and SC Media, among others.

Related Posts