The Rhysida ransomware gang has been observed partaking in opportunistic attacks recently, leveraging Rhysida ransomware against ‘targets of opportunity,’ targeting organizations across a range of industries, such as the education, healthcare, manufacturing, information technology, and government sectors. The Federal Bureau of Investigation (FBI) and the US Cybersecurity and Infrastructure Security Agency CISA), along with the Multi-State Information Sharing Agency Center (MS-ISAC), released a joint advisory on November 15th, 2023 in response to these attacks taking place as well in the wake of the US Department of Health and Human Services (HHS) warning that many of the recent attacks on healthcare organizations were the fault of the Rhysida threat actors. Rhysida operates as a Ransomware-as-a-Service (RaaS) model, compromising organizations and splitting ransom payments among affiliates, engaging in double extortion tactics where a ransom is demanded to decrypt victims’ data and avoid leaking exfiltrated data. They’ve been around since May 2023, quickly making a name for themselves after breaching and leaking the stolen data of the Chilean Army. The advisory includes indicators of compromise (IOCs), detection info, and Rhysida tactics, techniques, and procedures (TTPs) observed during investigation. Rhysida threat actors have been observed using phishing attacks, exploiting the Zerologon vulnerability (CVE-2020-1472) to gain initial access and persistence within a network, and hacking into external-facing remote services like VPNs when targeting organizations that didn’t have Multi-Factor Authentication (MFA) enabled. The joint advisory also highlighted that Vice Society ransomware group affiliates (aka Vanilla Tempest or DEV-0832) had been recorded shifting to the use of Rhysida ransomware payloads in their attacks starting in July 2023. CTIX analysts recommend that administrators patch actively exploited vulnerabilities and enable MFA across all services, among other recommendations noted in the joint advisory.