Rhysida: What the Attack on Berlin Means for Your Organization

On September 4, 2026, the ransomware group Rhysida published 5.8 terabytes of data from the Berlin state network. This advisory describes the actor, its attack chain, which has remained unchanged since 2023, and the actions that now take priority.

Audience

Regulated companies and public bodies in Germany, Austria and Switzerland, CISOs, heads of IT, SOC

Regulation

NIS2 · DORA · ISO 27001:2022 · KRITIS (German critical infrastructure)

Classification

TLP:CLEAR, sharing permitted

As of

September 7, 2026, version 1.1

Sources

TIRAS data set, BSI, CISA, Fortinet, Check Point, Trend Micro, Gen Digital, Microsoft, IBM X-Force, Expel, Berlin Senate

Changes

Version 1.1 of September 7, 2026. Added: the initial access via the TerminalFix campaign confirmed by the BSI (BITS-B 2026-287419-1032), a sixth immediate action on execution control, three rows in the TTP mapping, the leak site’s publication rate and the indicators of the TerminalFix campaign. First version September 4, 2026, 6:00 p.m.

The Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and the Environment are affected. According to Florian Hauer, State Secretary for Digital Affairs, the exfiltration ran from August 7 to 12 and was discovered on August 14. On September 1, Senate spokesperson Christine Richter confirmed that passwords stored in plaintext in Office files had also been exfiltrated. Around 12,000 of the state’s systems were checked.

Rhysida claims to have stolen 1.44 million files: more than 46,500 contracts, more than 5,000 personnel files, payroll records, administrative fine proceedings, confidential documents from Bundesrat committees, vulnerability analyses of Berlin’s drinking water supply and plaintext access credentials for administrative databases and payment service providers. Governing Mayor Kai Wegner stated: “The State of Berlin will not be blackmailed.” The State Criminal Police Office and the BSI are investigating.

The BSI described the initial access on September 4 in warning BITS-B 2026-287419-1032 without naming the affected body; heise linked the warning to the Berlin case on September 7. According to this, the attack did not begin with stolen credentials but with a user: a compromised website displayed a fake Cloudflare captcha, copied a PowerShell command to the clipboard and prompted the user to run it in Windows Terminal. The command downloaded a ZIP archive whose malicious code started via DLL sideloading, established persistence via the registry and an hourly task, scouted Active Directory and backup systems and opened a Python reverse tunnel over TLS on port 443. The BSI calls the campaign TerminalFix, an evolution of ClickFix, and attributes the malware used, LoremIpsumLoader, to the group behind Rhysida.

As early as May 21, 2026, Rhysida had listed the state capital Stuttgart on its leak site and demanded 5 bitcoin, around €333,000. There was no encryption; the city stated that it had no indication of a cyber incident. A leak site entry is a claim by the perpetrators, not a confirmed incident. For Germany, the TIRAS data set counts nine Rhysida entries since June 2023, for Switzerland six and for Austria two.

Rhysida is a ransomware-as-a-service operation that appeared in May 2023 and has run a leak site on the Tor network since June 5, 2023. The group steals data, encrypts systems and auctions off the loot with a minimum bid and a seven-day deadline. If the auction finds no buyer, a large part is published. Its origin is unknown. Microsoft tracks the most active affiliate as Vanilla Tempest, known to other vendors as Vice Society or VICE SPIDER. The BSI lists the group as Vice Spider (also White Nefas, White Hekate, DEV-0832), active since at least mid-2021 and, since June 2023, almost exclusively with Rhysida. IBM X-Force assesses the group Interlock, active since September 2024, as a likely offshoot with a shared malware base.

Type

Ransomware as a service, double extortion (encryption plus auction of stolen data)

Active since

May 2023; leak site since June 5, 2023; last action September 4, 2026

Publication rate

In 92% of cases, being named on the leak site is followed by publication of the data, after 11 days on average (BSI, citing a commercial service provider). Berlin: 7 days.

Leak site entries per year

2023: 78, 2024: 85, 2025: 94, 2026 through September 4: 24. Source: TIRAS, ransomware.live sync of September 2, 2026.

Target sectors (TIRAS, 168 entries with sector)

Healthcare 23%, public administration 18%, education 12%, business services 12%, manufacturing 11%, technology 5%, transport 5%, finance 4%

Target countries (TIRAS, 212 entries with country)

USA 52%, Canada 8%, United Kingdom 5%, Germany 4%, Australia 4%, Italy 4%, Switzerland 3%

Related actors

Vanilla Tempest / Vice Society (affiliate, Microsoft), Interlock (offshoot, IBM X-Force), initial access broker TAG-124 and Gootloader

Known victims

Chilean Army (05/2023), British Library (10/2023), Insomniac Games (12/2023), City of Columbus (07/2024), Port of Seattle (08/2024), Maryland Department of Transportation (09/2025), state capital Stuttgart (05/2026), State of Berlin (08/2026)

Threat level for Germany, Austria and Switzerland: HIGH

Two German administrations in four months; the target type matches the scope of NIS2 and critical infrastructure.

Moderate capability, high resources: Rhysida does not use zero-day vulnerabilities. No incident response report documents an exploited CVE; the Zerologon claim circulating in secondary sources has no primary evidence. Instead, the group invests in infrastructure: more than 40 code signing certificates in a single campaign in 2025, more than 200 certificates revoked by Microsoft in October 2025.

Compiled from CISA warning AA23-319A, Fortinet’s incident response analysis of an incident in July 2023, Check Point Research, Trend Micro, Microsoft and the BSI warning of September 4, 2026. The chain has remained stable for three years; only initial access has broadened.

The thirteen techniques in the chain that become visible earliest and are easiest to detect. The Sigma column shows how many ready-made detection rules from the SigmaHQ community are available in TIRAS for the technique; the log source is the minimum requirement. The CIS Controls name the countermeasure with the greatest leverage.

Without command line auditing (event 4688 with the process command line), the detections for credential dumping, reconnaissance and encryption are blind. In the Fortinet case, missing script block logging prevented the reconstruction of the PowerShell activity.

Public administration is part of the supply chain

The Berlin state administration is not subject to the German critical infrastructure ordinance (BSI-KritisV). Nevertheless, it held vulnerability analyses of the water supply, Bundesrat documents and payment credentials. Anyone who shares data with authorities, service providers or associations must include their security level in their own risk assessment (NIS2 Art. 21(2)(d), ISO 27001 A.5.19 to A.5.22).

Dwell time is the problem, not encryption

In Berlin, the exfiltration went unnoticed for five days; at the British Library, 440 GB left in one night. Rhysida only encrypts after the data is gone. Detection in the reconnaissance or exfiltration phase prevents extortion; detection at encryption no longer does.

MFA gaps on the domain

The British Library had MFA for cloud services but not for the terminal server on the domain. That server is how the adversary got in. Check every remote access that leads directly into Active Directory: VPN, RDP gateways, Citrix, terminal servers, service provider maintenance access.

The user is the initial access

In Berlin, there was neither a vulnerability nor a stolen password. An employee ran a command that a website presented to them. MFA and patch levels do not help against this. What helps: standard users are not allowed to run arbitrary PowerShell commands, Windows Terminal warns when multi-line commands are pasted, and awareness training shows fake captchas, not just fake invoices.

Hypervisors are a target

Rhysida encrypts ESXi hosts via SSH before Windows systems are next. In the Fortinet case, restrictive vSphere and Veeam permissions prevented widespread encryption. The management network, SSH access and backup consoles belong separated from the client network.

Fake software from search engines

Since 2024, initial access has also come via Bing and Google ads for fake Teams, PuTTY and Zoom installers with valid signatures. If you allow employees to download software themselves, you need download restrictions and ad filters.

Leak site before incident

In Stuttgart and Columbus, the leak site entry appeared before the incident had been detected or confirmed internally. Leak site monitoring often provides the first indication.

Rhysida does not use zero-days. The group exploits missing MFA, missing logging, unprotected hypervisors, passwords in Word files and users who are allowed to run any command. These are solvable problems if you know where to start.

Selection from CISA AA23-319A, Fortinet, ransomware.live and Microsoft (TerminalFix, August 28, 2026). Host artifacts are more stable than hashes and IP addresses; the encryptor binaries are rebuilt for each victim, and the IP addresses date from summer 2023.

Complete hash lists: CISA AA23-319A (more than 40 SHA-256 hashes) and Cisco Talos. For the malvertising campaign, Expel maintains an indicator list on GitHub.

Vanilla Tempest / Vice Society

Microsoft tracks Vanilla Tempest (formerly DEV-0832, known to other vendors as VICE SPIDER or Vice Society) as a financially motivated actor that primarily uses Rhysida, alongside INC Ransomware. In August 2023, Check Point found identical artifacts: the NTDS backup path temp_l0gs, identical firewall rule names and the PortStarter backdoor, while Vice Society had stopped publishing victims after June 21, 2023. The CISA warning explicitly mentions the overlap.

Interlock

IBM X-Force assesses Interlock, active since September 2024, as a likely offshoot from the Rhysida environment. Both use the Supper backdoor with different crypters and share code structures between NodeSnake, InterlockRAT and Supper.

Access brokering

In May 2024, the initial access broker TAG-124 supplied the Broomstick loader for Rhysida and switched to Interlock in September 2024. Gootloader provides access to both groups. The malvertising campaigns ran from May to September 2024 with seven certificates and from June 2025 with more than forty; Microsoft detected them at the end of September 2025, attributed them to Vanilla Tempest and revoked more than 200 certificates in early October, issued via Microsoft Trusted Signing, SSL.com, DigiCert and GlobalSign. In August 2026, Microsoft described the TerminalFix campaign without attributing it to an actor; the BSI attributes the malware used in it, LoremIpsumLoader (also AxolotLoader), which BlueVoyant had previously found in trojanized Teams installers, to the same group that operates Rhysida.

BSI, BITS-B 2026-287419-1032, German institutions compromised via TerminalFix campaign (September 4, 2026, German); Microsoft, TerminalFix campaign deploys a reverse tunnel through multistage intrusion (August 28, 2026); BlueVoyant, Lorem Ipsum Malware (2026); heise, BSI explains first attack vector against Berlin authorities (September 7, 2026, German); MITRE ATT&CK T1204.004; CISA/FBI/MS-ISAC AA23-319A (November 15, 2023, updated 04/2025); Fortinet FortiGuard, Analyzing Rhysida Ransomware Intrusion (11/2023) and Ransomware Roundup Rhysida (08/2023); Check Point Research (08/2023); Trend Micro (08/2023); Gen Digital, Rhysida Ransomware Technical Analysis (October 26, 2023); Kim et al., Kookmin University / KISA (02/2024); British Library, Cyber Incident Review (March 8, 2024); Microsoft Threat Intelligence (10/2025); Expel, Certified OysterLoader (10/2025); IBM X-Force, Interlock and Rhysida within the ransomware ecosystem; ransomware.live (September 4, 2026); Berlin Senate via heise (September 1, 2026) and dpa (August 28 and September 4, 2026); heise on Stuttgart (05/2026). All information is based on publicly available sources and the TIRAS data set. Leak site entries are claims by the perpetrators. Victim data only in aggregated form.

ATT&CK

MITRE knowledge base of adversary tactics and techniques; T numbers denote techniques

C2

Command and control: infrastructure for remotely controlling compromised systems

ClickFix / TerminalFix

Social engineering technique: a website gets the user to run a copied command themselves in the Run dialog (ClickFix) or in Windows Terminal (TerminalFix)

CIS Controls

Center for Internet Security Controls: prioritized catalog of IT security measures

ESXi

VMware hypervisor on which virtual machines run

FIDO2

Phishing-resistant authentication standard

IdP

Identity provider: central sign-in service, such as Entra ID

IOC

Indicator of compromise: technical characteristic of an attack

Leak site

Tor website on which extortion groups name victims and publish data

LOLBin

Living off the land binary: legitimate system tool that adversaries misuse

MFA

Multi-factor authentication

NTDS

Active Directory database with all accounts and password hashes

RaaS

Ransomware as a service: the operator provides malware and infrastructure, affiliates carry out attacks

RMM

Remote monitoring and management: remote maintenance software such as AnyDesk

Sigma

Vendor-neutral format for detection rules; SigmaHQ is the community collection

TLP

Traffic Light Protocol: marking that indicates how widely information may be shared

WDAC

Windows Defender Application Control: allows only approved programs and scripts

TTP

Tactics, techniques, procedures: the methods adversaries use