kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · not yet in the cluster map

rhysida

also tracked as 8base 1, akira 1, black basta 1, interlock 1, kongtuke 1, qilin 1, woodgnat 1

4 stories · 4 in the wild · June 25, 2026 – September 8, 2026

evidence: 4 observed

sectors

  • government 3 · Sep 8
  • education 1 · Jun 25
  • technology 1 · Jun 25

geography

  • germany 3 · Sep 8

malware and tools

  • rhysida 1 · Sep 6
  • mistic 1 · Jun 25

techniques

  • credential theft 1 · Sep 8
  • exfiltration 1 · Aug 30

attack phases seen

  • Impact 2 · Sep 6
  • Collection 1 · Sep 8
  • Exfiltration 1 · Aug 30
  • Initial access 1 · Jun 25

what we reported, newest first, grouped by story

Aug 30 – September 8, 2026 · 3 reports

  • Berlin is investigating a second trove of city government data published online, this time including stolen login credentials, with Germany's BSI issuing a separate warning about Rhysida (The Record, earlier coverage). · Sep 8 · observed · Breaches
  • Berlin says Rhysida followed through on its leak threat and published roughly 5.8 TB of stolen government data. Authorities launched a crisis response and forensic review after refusing to pay the group. Reuters reports the material escalation from the original extortion claim (earlier coverage). · Sep 6 · observed · Incidents & Extortion
  • Rhysida is auctioning 5.79 TB it claims to have stolen from Berlin's state agencies, and the State of Berlin has confirmed an active extortion attempt it will not meet (The Hacker News, SecurityAffairs). Forensics has since uncovered additional exfiltration from the Senate Department for Mobility, Transport, Climate Protection and Environment; Governing Mayor Kai Wegner and Interior Senator Iris Spranger say "the State of Berlin will not be blackmailed" (Senate statement). Timing lands just before city elections. · Aug 30 · observed · Threat Activity

Jun 19 – June 25, 2026

  • Mistic, a stealthy new RAT, is the entry point for initial-access broker Woodgnat (aka KongTuke), who feeds ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta, hitting insurance, education, IT, and professional-services targets. BleepingComputer, SecurityWeek · Jun 25 · observed · as woodgnat, kongtuke, qilin, interlock, akira, 8base, black basta · Threat Intelligence