Threat reportRansomwareTL-2026-2357
Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026)
Rhysida ransomware, deployed by the Vanilla Tempest access crew (formerly Vice Society/Storm-0832), targeted German state capitals in 2026. Stuttgart was listed on the Rhysida leak site in May 2026 with a 5 BTC demand.
Key facts for Rhysida Stuttgart Berlin attacks
Detection coverage for Rhysida Stuttgart Berlin attacks
As of 2026-09-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2357 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Supper/Oyster Backdoor C2 Beaconing and Protocol Tunneling Detection
Detects C2 communication to known Supper backdoor and OysterLoader infrastructure used by Vanilla Tempest. Supper backdoor operates on non-standard ports (8080, 1080, 4043, 8443, 53/DNS tunnel) and connects to known C2 IPs (151.241.99.169, 46.183.25.6, 213.139.77.167, 193.104.58.42, 185.233.166.26, 51.222.96.58, etc.). OysterLoader uses domains grandideapay.com, cardlowestgroup.com, socialcloudguru.com, coretether.com, nucleusgate.com, registrywave.com with API paths /api/v2/init and /api/v2/facade. Also detects protocol tunneling (T1572) via DNS-over-HTTPS or SSH tunneling as alternative C2 channels. Community-correlated sibling domains (wsp.sm188dnsxx.top, sha.sm188dvlv.icu, trekmesh15.com, aspen-92.com) are included as complementary indicators.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1572, T1018, T1219, T1041
- Data sources: sysmon_network_connection_eventid_3, windows_firewall_log, web_proxy_logs, dns_query_logs, microsoft_defender_devicenetworkevents
- Severity: critical
- Confidence: high
Splunk SPL
index=network sourcetype=firewall OR index=proxy sourcetype=access_combined OR index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(dest_ip="151.241.99.169" OR dest_ip="46.183.25.6" OR dest_ip="213.139.77.167" OR
dest_ip="193.104.58.42" OR dest_ip="5.226.141.216" OR dest_ip="178.32.224.221" OR
dest_ip="213.232.236.211" OR dest_ip="185.233.166.26" OR dest_ip="194.61.120.130" OR
dest_ip="37.72.168.146" OR dest_ip="38.134.148.147" OR dest_ip="51.222.96.58" OR
dest_ip="95.169.180.113" OR dest_ip="91.236.230.130" OR dest_ip="91.236.230.101" OR dest_ip="45.91.168.240" OR
dest_host="grandideapay.com" OR dest_host="cardlowestgroup.com" OR dest_host="socialcloudguru.com" OR
dest_host="coretether.com" OR dest_host="nucleusgate.com" OR dest_host="registrywave.com" OR
dest_host="scs-techresources.com" OR dest_host="signspace.cloud" OR dest_host="microsoft-teams.icu" OR
dest_host="wsp.sm188dnsxx.top" OR dest_host="sha.sm188dvlv.icu" OR dest_host="tak.123ful.net" OR
dest_host="froodlesphere.com" OR dest_host="trekmesh15.com" OR dest_host="aspen-92.com" OR dest_host="aspencore18.com" OR dest_host="chisel-84.com")
| eval c2_port=dest_port
| eval c2_family=case(
match(dest_ip, "151\.241|46\.183|213\.139|193\.104|5\.226|178\.32|213\.232"), "Supper_Backdoor",
match(dest_ip, "185\.233|194\.61|37\.72|38\.134|51\.222|95\.169"), "Supper_Backdoor_Apr2026",
match(dest_host, "grandideapay|cardlowestgroup|socialcloudguru"), "OysterLoader_C2",
match(dest_host, "coretether|nucleusgate|registrywave"), "Broomstick_C2",
1=1, "Community_Observed")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_host, dest_port, c2_family
| where count >= 1
| eval severity_level=case(c2_family="Supper_Backdoor" OR c2_family="Supper_Backdoor_Apr2026" OR c2_family="OysterLoader_C2", "CRITICAL", 1=1, "HIGH")
| table first_seen, last_seen, src_ip, dest_ip, dest_host, dest_port, c2_family, count, severity_level
| sort - last_seenMicrosoft KQL
let KnownSupperC2IPs = dynamic(["151.241.99.169", "46.183.25.6", "213.139.77.167", "193.104.58.42", "5.226.141.216", "178.32.224.221", "213.232.236.211", "185.233.166.26", "194.61.120.130", "37.72.168.146", "38.134.148.147", "51.222.96.58", "95.169.180.113", "91.236.230.130", "91.236.230.101", "45.91.168.240"]);
let KnownC2Domains = dynamic(["grandideapay.com", "cardlowestgroup.com", "socialcloudguru.com", "coretether.com", "nucleusgate.com", "registrywave.com", "scs-techresources.com", "signspace.cloud", "microsoft-teals.icu", "microsoft-teams.icu", "wsp.sm188dnsxx.top", "sha.sm188dvlv.icu", "tak.123ful.net", "tak.sm188dvlv.icu", "froodlesphere.com", "trekmesh15.com", "aspen-92.com", "aspencore18.com", "chisel-84.com", "rrr.12naga.org", "tra.12naga.org"]);
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteIP in (KnownSupperC2IPs) or RemoteUrl in (KnownC2Domains) or RemoteUrl has_any (".sm188dnsxx.top", ".sm188dvlv.icu", ".1234e.org", ".12naga.org")
| extend C2Family = case(
RemoteIP in ("151.241.99.169", "46.183.25.6", "213.139.77.167", "193.104.58.42", "5.226.141.216", "178.32.224.221", "213.232.236.211"), "Supper_Backdoor",
RemoteIP in ("185.233.166.26", "194.61.120.130", "37.72.168.146", "38.134.148.147", "51.222.96.58", "95.169.180.113"), "Supper_Backdoor_Apr2026",
RemoteUrl has_any ("grandideapay.com", "cardlowestgroup.com", "socialcloudguru.com"), "OysterLoader_C2",
"Community_Observed_C2")
| extend SuspiciousPorts = RemotePort in (53, 8080, 1080, 4043, 8443, 4443, 8888)
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, RemotePort, TransportProtocol, C2Family, SuspiciousPorts
| sort by Timestamp descSigma
title: Network Connection to Rhysida/Vanilla Tempest C2 Infrastructure
id: 23570007-0000-4000-a000-000000000007
status: experimental
description: Detects outbound network connections from compromised hosts to known Supper backdoor C2 IPs on non-standard ports (8080, 1080, 4043, 8443, 53), OysterLoader C2 domains (grandideapay.com, cardlowestgroup.com), Broomstick domains (coretether.com, nucleusgate.com), and community-correlated sibling infrastructure (.sm188dnsxx.top, trekmesh15.com)
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-06
references:
- https://malware.news/t/rhysida-in-germany-from-an-early-ransomware-payload-to-the-2026-stuttgart-and-berlin-threat/125374
- https://securityintelligence.com/posts/vanilla-tempest-rhysida-fake-microsoft-teams/
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
tags:
- attack.command_and_control
- attack.t1572
- attack.t1219
- attack.exfiltration
- attack.t1041
logsource:
category: network_connection
product: windows
definition: Requires Sysmon EventID 3 (network connection) or Windows Defender Firewall/ETW network events, or proxy/firewall logs
detection:
selection_supper_ips:
DestinationIp|contains:
- '151.241.99.169'
- '46.183.25.6'
- '213.139.77.167'
- '193.104.58.42'
- '5.226.141.216'
- '178.32.224.221'
- '213.232.236.211'
- '185.233.166.26'
- '194.61.120.130'
- '37.72.168.146'
- '38.134.148.147'
- '51.222.96.58'
- '95.169.180.113'
selection_c2_domains:
DestinationHostname|contains:
- 'grandideapay.com'
- 'cardlowestgroup.com'
- 'socialcloudguru.com'
- 'coretether.com'
- 'nucleusgate.com'
- 'registrywave.com'
- 'scs-techresources.com'
- 'signspace.cloud'
selection_community:
DestinationHostname|contains:
- '.sm188dnsxx.top'
- '.sm188dvlv.icu'
- '.1234e.org'
- '.12naga.org'
- 'trekmesh15.com'
- 'aspen-92.com'
- 'chisel-84.com'
- 'aspencore18.com'
- 'froodlesphere.com'
condition: selection_supper_ips or selection_c2_domains or selection_community
falsepositives:
- IP addresses that have been recycled by legitimate cloud providers since the campaign ended
- Domains that were re-registered by security researchers or sinkholed after the campaign
- Legitimate services hosted on shared IPs with C2 infrastructure before attribution was known
level: critical
Known false positives:
- Legitimate SaaS or CDN services that happen to share IP space with former C2 infrastructure
- DNS queries to sinkholed or captured domains that are now operated by security vendors or researchers
Tuning notes: Maintain a current C2 IOC blocklist — the Supper backdoor C2 infrastructure changes IPs every ~5 days (observed pattern). The April 2026 IP set (185.233.166.26, 194.61.120.130, etc.) uses DNS tunneling on port 53 — correlate DNS query logs for high-frequency queries to algorithmically generated subdomains. Community-correlated domains from TL_OSINT_Scan (sm188dnsxx.top, trekmesh15.com) provide early-warning for Vidar stealer C2 that may precede Rhysida deployment.
- Fraudulent Code-Signing Certificate Abuse — Fox Tempest Signing Anomalies · unlock with TL Creds
- Process Injection and Vidar Infostealer — Oyster/Broomstick Backdoor Payload Behavior · unlock with TL Creds
- Azure Blob Storage Exfiltration and RDP Lateral Movement Detection · unlock with TL Creds
- Trojanized Signed Installer Execution in Non-Standard Location · unlock with TL Creds
- NTDS Credential Dumping, Event Log Clearing, and Active Directory Discovery · unlock with TL Creds
- Rhysida Ransomware Execution — File Encryption, Ransom Note, and Volume Shadow Copy Deletion · unlock with TL Creds
- Malvertising / SEO Poisoning — Fake Software Installer Download Detection · unlock with TL Creds
- AlphaSecurity Scheduled Task and PowerShell Backdoor Persistence Chain · unlock with TL Creds
Indicators of compromise for Rhysida Stuttgart Berlin attacks
As of 2026-09-06, Threadlinqs Intelligence tracks 37 indicators of compromise for TL-2026-2357.
Sample indicators (3 of 37)
- IP address:
151.241.99[.]169 - Domain:
signspace[.]cloud - URL:
hxxps://oij89jiiuguygh[.]blob[.]core[.]windows[.]net/
Defanged, TLP:CLEAR. Full set of 37 indicators: unlock with TL Creds.
Community OSINT corroboration for Rhysida Stuttgart Berlin attacks
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
How Rhysida Stuttgart Berlin attacks works
In August, a major breach of Berlin state agencies exfiltrated 5.79 TB of data (~1.44 million files) including classified government material, critical-infrastructure security assessments for Berlin's water supply, CBRN threat planning documents, national defense plans, 3,226 NDAs, 148 IBANs, plaintext credentials, and personal data on 12,076 individuals. Berlin refused the 30 BTC ransom (~€2M); the data was published on the dark web on September 4-5, 2026, 15 days before the Berlin state election.
Rhysida ransomware, active since May 2023 as a ransomware-as-a-service (RaaS) operation, has conducted a sustained campaign against German public administration in 2026. The threat involves a sophisticated multi-stage infection chain orchestrated by the Vanilla Tempest threat cluster (formerly tracked by Microsoft as Storm-0832/DEV-0832, also known as Vice Society), who serve as an access and deployment crew. The infection chain begins with malvertising and search-engine optimization (SEO) poisoning — users searching for trusted software (Microsoft Teams, PuTTY, Zoom, WinSCP, AutoDesk, Google Authenticator) are redirected to fraudulent download pages hosting trojanized, fraudulently-signed installers. These installers deploy the Endico downloader (protected by the Tomb crypter), which retrieves the Broomstick/Oyster backdoor, followed by Vidar infostealer and/or the Supper backdoor for persistent post-compromise access. Hands-on-keyboard operators then conduct extensive Active Directory discovery using native Windows tools (PowerShell, nltest, net commands, systeminfo, ipconfig) before deploying the Rhysida ransomware payload. The code-signing infrastructure was enabled by Fox Tempest, a malware-signing-as-a-service operation Microsoft disrupted in May 2026, which created over 1,000 fraudulent certificates using Azure Artifact Signing infrastructure. Fox Tempest activity was observed immediately before Stuttgart appeared on the Rhysida leak site on May 19, 2026. The Berlin intrusion involved data exfiltration between August 7-12, 2026 from the Senate administration network. Affected departments were disconnected on August 14 after discovery. The exfiltrated data is extraordinary in scope: 5.79 TB comprising 1,439,893 files spanning mapping/geodata (124,823 files), legal/complaints (77,939), financial records (55,553), contracts (46,522), HR files (27,299), confidential documents (11,777), infrastructure assessments (8,110), password-containing files (5,941), health records (2,738), and contact files (2,287). Critically, the cache included CBRN (Chemical, Biological, Radiological, Nuclear) threat planning documents, Berlin water supply vulnerability assessments, LKA (State Criminal Police) investigation files, national defense plans including federal emergency communication channels, Bundesrat committee records, classified-material handling documentation, SQL database dumps spanning 2020-2026, passport/ID scans, and payroll data. The Berlin government led by Mayor Kai Wegner and Interior Senator Iris Spranger refused the ransom, stating the state of Berlin does not submit to extortion. Multiple task forces were activated including the State Criminal Police, public prosecutor's office, and federal security agencies. The stolen data was published on the dark web on September 4-5, 2026 after the ransom deadline expired. The breach occurred 15 days before Berlin's House of Representatives election (September 20, 2026); while election infrastructure was confirmed uncompromised, the BSI warned of potential hack-and-leak operations. Rhysida has claimed approximately 280-295+ victims globally since 2023, primarily targeting education (~35%), healthcare, government, manufacturing, and technology sectors. Notable prior victims include the Chilean Army (May 2023, ~360,000 documents leaked), Prospect Medical Holdings (August 2023, 16+ hospitals, 1.3M+ affected), the British Library (October 2023, ~600GB data exfiltrated), and Lurie Children's Hospital (January 2024, ~776,000 affected).
MITRE ATT&CK techniques by tactic:
Credential Access
T1003.003 OS Credential Dumping: NTDS
Discovery
T1018 Remote System Discovery; T1069.002 Permission Groups Discovery: Domain Groups; T1087.002 Account Discovery: Domain Account; T1482 Domain Trust Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1570 Lateral Tool Transfer
Defense Evasion
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Privilege Escalation
T1055.002 Process Injection: Portable Executable Injection
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.009 Command and Scripting Interpreter: Cloud API
Initial Access
command-and-control
Impact
T1490 Inhibit System Recovery; T1657 Financial Theft
Collection
defense-impairment
T1553.002 Subvert Trust Controls: Code Signing; T1685.005 Clear Windows Event Logs
Command and Control
Resource Development
Remediation for Rhysida Stuttgart Berlin attacks
Patches
- Apply all Patch Tuesday updates prioritizing CVE-2020-1472 (Zerologon) and other KEV-listed vulns
- Update PowerShell to version 5.0+ for adequate logging capability
- Ensure all VPN appliances and remote access gateways are fully patched
Immediate actions
- Isolate affected systems and disconnect compromised network segments
- Revoke all exposed credentials and force password reset for all domain accounts
- Block known C2 infrastructure IPs and domains at perimeter
- Enable enhanced PowerShell logging and command-line process auditing across all endpoints
- Deploy EDR detection rules for the AlphaSecurity scheduled task and Rhysida encryption artifacts
Workarounds
- Apply application controls to prevent unauthorized remote access software (AnyDesk, etc.)
- Restrict RDP to jump-box systems with MFA enforcement
- Disable command-line/scripting permissions where operationally feasible
- Add email banners for external communications and disable hyperlinks in received emails
Longer-term hardening
- Implement phishing-resistant MFA for all remote access (VPN, webmail, critical systems)
- Deploy network segmentation to contain lateral movement
- Restrict PowerShell execution to case-by-case basis via Group Policy
- Implement application allowlisting for remote access tools
- Deploy offline, encrypted, immutable backups with daily-to-weekly restoration testing
- Establish continuous monitoring for AZCopy/StorageExplorer usage as exfiltration indicator
- Implement Just-in-Time (JIT) privileged access management
Affected and fixed versions
- Microsoft — Windows Server
Vulnerable versions: 2008; 2012; 2016; 2019; 2022
Fixed in: Patched versions post-August 2020 (KB4565349+) - Microsoft — Azure Trusted Signing
Vulnerable versions: Pre-May 2026 infrastructure (Fox Tempest abuse)
Fixed in: Post-May 2026 with revocation of 1,000+ fraudulent certificates
Timeline of Rhysida Stuttgart Berlin attacks
- Rhysida ransomware first observed in the wild; Chilean Army attack with ~360,000 documents leaked marks one of the most consequential military ransomware attacks on record
- Rhysida attacks British Library, exfiltrating ~600 GB of data (490,000+ files); library refuses £600K ransom; operational disruption lasted months
- Vanilla Tempest threat cluster begins using Fox Tempest malware-signing-as-a-service to fraudulently sign trojanized Microsoft Teams installers and Oyster backdoor payloads
- Microsoft detects the fake Teams campaign and revokes over 200 fraudulent code-signing certificates issued through Azure Trusted Signing, SSL.com, DigiCert, and GlobalSign
- Supper backdoor C2 infrastructure observed heavily active across multiple IPs (locked-ioc-27, locked-ioc-28, locked-ioc-34, locked-ioc-29, locked-ioc-35, locked-ioc-30) indicating sustained post-compromise access across multiple victims
- Microsoft publishes Fox Tempest investigation — malware-signing-as-a-service operation created over 1,000 certificates and hundreds of Azure tenants/subscriptions abusing Artifact Signing infrastructure; supply-side takedown executed
- City of Stuttgart appears on Rhysida data-leak site with a 5 BTC ransom demand; Stuttgart initially states it has no evidence confirming a cyber incident
- Data exfiltration begins from Berlin state administration network; attackers exfiltrate 5.79 TB over a 6-day window spanning August 7-12
- Berlin affected Senate departments disconnected from the state network upon discovery of the intrusion; forensic investigations subsequently uncover additional data loss
- Rhysida gang publicly claims responsibility for the Berlin attack, listing the city on their leak site with a 30 BTC (~€2M) ransom demand and countdown timer
- Berlin city administration confirms data theft; Mayor Kai Wegner states 'The state of Berlin is being blackmailed' and refuses to pay ransom; Interior Senator Iris Spranger confirms election infrastructure secure
- Rhysida publishes stolen Berlin data on the dark web after ransom deadline expires; 1,439,893 files (~6 TB) including CBRN threat planning, national defense plans, LKA investigation documents, water supply assessments, classified government material, and personal data published
- Berlin state election for the House of Representatives scheduled; hack-and-leak concerns raised by BSI; election infrastructure confirmed uncompromised but data leak creates significant political crisis
Sources cited for Rhysida Stuttgart Berlin attacks
- StopRansomware: Rhysida Ransomware (AA23-319A) CISA · Advisory · 2025-04-30
- CISA Known Exploited Vulnerabilities Catalog CISA · Advisory · 2026-08-15
- Rhysida in Germany — From an Early Ransomware Payload to the 2026 Stuttgart and Berlin Threat malware.news · Research · 2026-09-05
- Microsoft investigates Fox Tempest malware-signing-as-a-service Microsoft Security Response Center · Vendor report · 2026-05-01
- IBM X-Force: Vanilla Tempest threat analysis securityintelligence.com · Research · 2026-05-15
- Fortinet: Analyzing Rhysida Ransomware Intrusion Fortinet · Research · 2025-01-15
- Ransomware.live: Rhysida Leak Site Tracker ransomware.live · Research · 2026-09-06
- Berlin election infrastructure secure, says Interior Senator Spranger berlin.de · Vendor report · 2026-09-01
- Berlin data breach: Rhysida ransomware attack explained Help Net Security · Blog · 2026-09-01
- CybelAngel: Rhysida Ransomware — TTPs, IOCs and Defence in 2026 cybelangel.com · Blog · 2026-06-10
- Berlin confirms data theft after Rhysida ransomware attack claims BleepingComputer · News · 2026-08-31
- Berlin city government says it won't submit to extortion after pre-election cyberattack reuters.com · News · 2026-08-28
- Berlin launches crisis response after hackers publish stolen data reuters.com · News · 2026-09-05
- Berlin cyberattack: Hackers leak highly sensitive data across dark web euronews.com · News · 2026-09-05
More from Rhysida
Other reports on CVE-2020-1472
- Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial Institutions
- Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observed
- LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)
- La Trobe University research: network-based detection of SMB shared-storage ransomware encryption
- Capita Black Basta Ransomware Incident (March 2023) — Record £14M UK ICO Fine for 6M+ Affected Individuals
- Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi
Previous and next in ransomware
Drafted by the Threadlinqs research pipeline from 14 sources; published ; last updated —.
