{
  "slug": "rhysida",
  "group": "rhysida",
  "name": "rhysida",
  "note": null,
  "attck": [],
  "activity": {
    "postings": 43,
    "first": "2026-08-13",
    "last": "2026-11-07",
    "countries": {
      "CH": 1,
      "US": 14,
      "??": 13,
      "MX": 1,
      "MY": 2,
      "BE": 1,
      "DE": 5,
      "VN": 1,
      "SE": 1,
      "PH": 1,
      "FR": 1,
      "HU": 1,
      "AU": 1
    },
    "sectors": {
      "finance": 4,
      "unknown": 8,
      "services": 11,
      "insurance": 1,
      "education": 3,
      "manufacturing": 3,
      "energy": 3,
      "government": 2,
      "technology": 2,
      "healthcare": 5,
      "consumer": 2
    },
    "recent": [
      {
        "date": "2026-11-07",
        "name": "Treuhand & Immobilien Abt AG",
        "country": "CH",
        "sectors": [
          "finance"
        ],
        "url": "https://www.ransomware.live/id/VHJldWhhbmQgJiBJbW1vYmlsaWVuIEFidCBBR0ByaHlzaWRh"
      },
      {
        "date": "2026-11-04",
        "name": "El Cajon, CA",
        "country": "US",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/RWwgQ2Fqb24sIENBQHJoeXNpZGE"
      },
      {
        "date": "2026-11-04",
        "name": "Juge, Napolitano, Ruli, Putfark & Pittman",
        "country": "??",
        "sectors": [
          "services",
          "insurance"
        ],
        "url": "https://www.ransomware.live/id/SnVnZSwgTmFwb2xpdGFubywgUnVsaSwgUHV0ZmFyayAmIFBpdHRtYW5Acmh5c2lkYQ"
      },
      {
        "date": "2026-11-03",
        "name": "Here at Pope and Johnson County Title Company",
        "country": "??",
        "sectors": [
          "finance"
        ],
        "url": "https://www.ransomware.live/id/SGVyZSBhdCBQb3BlIGFuZCBKb2huc29uIENvdW50eSBUaXRsZSBDb21wYW55QHJoeXNpZGE"
      },
      {
        "date": "2026-10-31",
        "name": "Phoenix Charter Academy",
        "country": "US",
        "sectors": [
          "education"
        ],
        "url": "https://www.ransomware.live/id/UGhvZW5peCBDaGFydGVyIEFjYWRlbXlAcmh5c2lkYQ"
      },
      {
        "date": "2026-10-30",
        "name": "Cipsa Industrias Sa De Cv",
        "country": "MX",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/Q2lwc2EgSW5kdXN0cmlhcyBTYSBEZSBDdkByaHlzaWRh"
      },
      {
        "date": "2026-10-30",
        "name": "INTI International University & Colleges",
        "country": "MY",
        "sectors": [
          "education"
        ],
        "url": "https://www.ransomware.live/id/SU5USSBJbnRlcm5hdGlvbmFsIFVuaXZlcnNpdHkgJiBDb2xsZWdlc0ByaHlzaWRh"
      },
      {
        "date": "2026-10-29",
        "name": "INTAX, Inc.",
        "country": "??",
        "sectors": [
          "finance"
        ],
        "url": "https://www.ransomware.live/id/SU5UQVgsIEluYy5Acmh5c2lkYQ"
      },
      {
        "date": "2026-10-29",
        "name": "ClaimTek Systems",
        "country": "??",
        "sectors": [
          "finance"
        ],
        "url": "https://www.ransomware.live/id/Q2xhaW1UZWsgU3lzdGVtc0ByaHlzaWRh"
      },
      {
        "date": "2026-10-28",
        "name": "Noelker and Hull",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/Tm9lbGtlciBhbmQgSHVsbEByaHlzaWRh"
      },
      {
        "date": "2026-10-27",
        "name": "Machelen (Belgium)",
        "country": "BE",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/TWFjaGVsZW4gKEJlbGdpdW0pQHJoeXNpZGE"
      },
      {
        "date": "2026-10-26",
        "name": "MISC Group",
        "country": "MY",
        "sectors": [
          "energy"
        ],
        "url": "https://www.ransomware.live/id/TUlTQyBHcm91cEByaHlzaWRh"
      }
    ]
  },
  "convergences": [
    {
      "name": "The Lawson Roofing Co Inc.",
      "flagged": "2026-07-23",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    }
  ],
  "reports": [
    {
      "url": "https://www.sophos.com/en-us/blog/terminalfix-and-lorem-ipsum-loader-enable-covert-tunneling",
      "publisher": "Sophos X-Ops",
      "published": "2026-09-30",
      "title": "TerminalFix and Lorem Ipsum Loader enable covert tunneling",
      "origin": "feed",
      "primary": false
    }
  ],
  "techniques": [],
  "cves": [],
  "indicators": {
    "list": [],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 0,
    "defendable": 0,
    "covered": 0,
    "uncovered": []
  }
}