Rhysida
reference profile · reported nexus: Unknown (not nationality)
Reference label documented in the linked government advisory. Read the dated source for its observed behaviors and scope. No current operator roster, activity status or victim claim is independently established by this index entry.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
29 observed public claim posts in the collection window 2025-11-21 through 2026-10-25. Accumulated bounded samples: newest 1,000 records from each of the current and previous source years, refreshed every six hours. Historical gaps are not filled. These are not confirmed attacks or unique victims. Dates are provider record dates; countries are provider classifications; unknown is retained. Source: Ransomfeed — Dario Fadda · CC BY 4.0. Adapted into anonymous counts by Kinwilder; no endorsement implied.
United States of America: 15 posts
Canada: 2 posts
Germany: 2 posts
Italy: 2 posts
Japan: 1 posts- Unknown / unclassified: 1 posts
Australia: 1 posts
France: 1 posts
Spain: 1 posts
Lebanon: 1 posts
Vietnam: 1 posts
Sweden: 1 posts
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
2026-10-29: The recovery control plane. Which administrative paths decide whether backups and hypervisors can restore service?
References
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a