Rhysida Ransomware Recovery: What's Recoverable

Rhysida surfaced in May 2023 and was significant enough that CISA and the FBI issued a joint advisory (AA23-319a) that November. It's a ransomware-as-a-service operation running the standard double-extortion playbook — encrypt, then threaten to leak — against healthcare, education, government and critical infrastructure targets across roughly 25 countries, most heavily in the United States.

Rhysida affiliates favour logging in over breaking in: valid or compromised credentials against externally facing services, particularly VPNs without multi-factor authentication, are the primary route, with Cobalt Strike used for lateral movement afterward. Encryption itself uses ChaCha20 for file content, with the ChaCha20 keys and initialization vectors wrapped in 4096-bit RSA, and appends a .rhysida extension. Notably, Rhysida uses periodic (intermittent) encryption — deliberately encrypting only sections of a file rather than the whole thing, both to move faster across a network and to evade detection tools that flag full-file encryption patterns.

That periodic-encryption behaviour is the detail that matters most for recovery: because Rhysida is skipping sections rather than encrypting exhaustively, larger files — databases, virtual disks, backup archives — often retain substantial unencrypted content even though the file as a whole reports as encrypted. Establishing how much of a given file survived intact is exactly what a technical assessment does before anything else. On the containment side, checking VPN and remote-access logs for the credential misuse this group relies on is worth doing alongside — not instead of — the recovery assessment.