Threat actor
Rhysida
Targeted sectorsHealthcare
Activity window in this corpus
The tracker's observed corpus window only — not this actor's lifetime and not evidence of dormancy outside these dates.
- Claim records
- First observed Latest observed
Verified ATT&CK phases represented
No verified ATT&CK mapping in this corpus
Origin and motivation
Origin and motivation not attributed.
No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.
Claims attributed to this actor or leak site
1 in this corpus- SIA Medical CentreHealthcaresource ↗
Leak-site claim activity
0 additional claims without a disclosure date
2026-082026-08
Leak-site claim data: ransomware.live (No data licence; credited voluntarily). Unverified claim.