A new addition has been made to the cyber-rogues’ gallery of ransomware gangs this week. Rhysida, a criminal group, has claimed responsibility for an attack on the British Library. The library has confirmed that personal data stolen in a cyber-attack last month has appeared for sale online.
Ransomware gangs use malicious software to infect an organization’s computers and render them inaccessible. They then demand a payment, usually in cryptocurrency, to unlock the files. In recent years, many gangs have adopted a technique called “double extortion,” where they steal data and threaten to release it online to strengthen their negotiating position.
Rhysida emerged as the assailant by posting low-resolution images of the stolen personal information online and offering it for sale on its leak site. The starting bid for the stolen data is 20 bitcoin, equivalent to about £590,000.
Rafe Pilling, the director of threat research at cybersecurity firm Secureworks, describes this as a classic example of a double extortion ransomware attack. The threat of leaking or selling stolen data is used as leverage to extort a payment.
While the British Library is a high-profile victim of Rhysida, the group is also responsible for attacks on government institutions in Portugal, Chile, and Kuwait. In August, it claimed responsibility for an attack on the US hospital group Prospect Medical Holdings.
US government agencies recently released an advisory note on Rhysida, stating that the ransomware variant has been deployed against various sectors since May. The agencies also discovered that Rhysida operates a “ransomware as a service” (Raas) operation, where it rents out the malware to other criminals and shares the ransom proceeds.
Rhysida is a relatively new name in the public eye. However, according to Secureworks, it has emerged from a criminal operation established in 2021 called Gold Victor. Criminal gangs often rebrand themselves when their existing name attracts too much attention from law enforcement.
The exact identity of the Rhysida gang is unknown, but it is assumed that they are Russian-speaking or members of the Commonwealth of Independent States. According to the US agencies, Rhysida attackers commonly use virtual private networks or phishing attacks to gain access to systems.
Cryptocurrency is the preferred form of ransom demand for Rhysida attackers, as it operates outside the conventional banking system and transactions can be obscured. The group sends ransom notes with the title “CriticalBreachDetected” in a PDF file and provides recipients with a unique code and instructions to contact them via a specialist web browser for untraceable communications.
While paying ransomware demands is heavily frowned upon in the UK, it is not illegal unless the proceeds are suspected to go to terrorists. In the US, the government discourages ransom payments, but it is not legally prohibited.
Ransomware payments have been on the rise, with average payments nearly doubling to £1.2m over the past year. Against this backdrop, new ransomware “brands” like Rhysida will continue to emerge.