Rhysdia Ransomware Emerges as a Significant Threat to Healthcare Security

A new ransomware group dubbed Rhysdia has gained notoriety in recent months, following a series of high-impact attacks on the healthcare sector. The group which first emerged in May 2023, has forced several government organizations and cybersecurity companies to closely analyze its activities.

Following its attack on the Chilean Army and Prospect Medical Holdings, which affected 17 hospitals and 166 clinics in the US, the group was deemed as a significant threat to the healthcare and public sector by the U.S. Department of Health and Human Services (HHS).

On August 4, HHS also released an advisory about the ransomware, while security companies like Trend Micro, SentinelOne, and CheckPoint published individual articles analyzing different facets of this malware.

Initial analysis of Rhysdia by SentinelOne showed that it was in early stages of development and missed standard malware features. Their attack techniques also consisted of phishing emails and deployment through cobalt Strike or similar platforms.

The analysis by CheckPoint reveals that the ransomware has close links with the now defunct Vice Society, based on their modus operandi and victim (education and healthcare) targeting method.

The attack technique employed by Rhysdia in this instance included remote desktop protocol, remote PowerShell sessions (WinRM), and use of PsExec for lateral movement. For avoiding detection, the malware was seen to delete logs and forensic artifacts, while SystemBC and AnyDesk was utilized to maintain persistence.

‘’The time to ransom (TTR) of the actors employing Rhysida ransomware is relatively low. It has been eight days from the first signs of lateral movement to the widespread ransomware deployment,’’ revealed CheckPoint analysis.

According to the HHS security bulletin, the ransomware targets are spread across the US, Australia, Western Europe, and South America. In the beginning, their primary targets were the education, manufacturing, government, managed service providers, and technology sector. However, now their primary focus seems to be the healthcare and public health sector.

The rapid spread and threat scope of Rhysdia makes it imperative for organizations to understand and monitor the tools and attack process of this ransomware, thus preventing such attacks in the future.