# Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026)

> Rhysida ransomware, deployed by the Vanilla Tempest access crew (formerly Vice Society/Storm-0832), targeted German state capitals in 2026. Stuttgart was listed on the Rhysida leak site in May 2026 with a 5 BTC demand. In August, a major breach of Berlin state agencies exfiltrated 5.79 TB of data (~1.44 million files) including classified government material, critical-infrastructure security assessments for Berlin's water supply, CBRN threat planning documents, national defense plans, 3,226 NDAs, 148 IBANs, plaintext credentials, and personal data on 12,076 individuals. Berlin refused the 30 BTC ransom (~€2M); the data was published on the dark web on September 4-5, 2026, 15 days before the Berlin state election.

- **Published:** 2026-09-06T00:00:00Z
- **Last reviewed:** 2026-09-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2357
- **ID:** TL-2026-2357
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Rhysida (Russia)
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2020-1472

## Description

Rhysida ransomware, active since May 2023 as a ransomware-as-a-service (RaaS) operation, has conducted a sustained campaign against German public administration in 2026. The threat involves a sophisticated multi-stage infection chain orchestrated by the Vanilla Tempest threat cluster (formerly tracked by Microsoft as Storm-0832/DEV-0832, also known as Vice Society), who serve as an access and deployment crew. The infection chain begins with malvertising and search-engine optimization (SEO) poisoning — users searching for trusted software (Microsoft Teams, PuTTY, Zoom, WinSCP, AutoDesk, Google Authenticator) are redirected to fraudulent download pages hosting trojanized, fraudulently-signed installers. These installers deploy the Endico downloader (protected by the Tomb crypter), which retrieves the Broomstick/Oyster backdoor, followed by Vidar infostealer and/or the Supper backdoor for persistent post-compromise access. Hands-on-keyboard operators then conduct extensive Active Directory discovery using native Windows tools (PowerShell, nltest, net commands, systeminfo, ipconfig) before deploying the Rhysida ransomware payload. The code-signing infrastructure was enabled by Fox Tempest, a malware-signing-as-a-service operation Microsoft disrupted in May 2026, which created over 1,000 fraudulent certificates using Azure Artifact Signing infrastructure. Fox Tempest activity was observed immediately before Stuttgart appeared on the Rhysida leak site on May 19, 2026. The Berlin intrusion involved data exfiltration between August 7-12, 2026 from the Senate administration network. Affected departments were disconnected on August 14 after discovery. The exfiltrated data is extraordinary in scope: 5.79 TB comprising 1,439,893 files spanning mapping/geodata (124,823 files), legal/complaints (77,939), financial records (55,553), contracts (46,522), HR files (27,299), confidential documents (11,777), infrastructure assessments (8,110), password-containing files (5,941), health records (2,738), and contact files (2,287). Critically, the cache included CBRN (Chemical, Biological, Radiological, Nuclear) threat planning documents, Berlin water supply vulnerability assessments, LKA (State Criminal Police) investigation files, national defense plans including federal emergency communication channels, Bundesrat committee records, classified-material handling documentation, SQL database dumps spanning 2020-2026, passport/ID scans, and payroll data. The Berlin government led by Mayor Kai Wegner and Interior Senator Iris Spranger refused the ransom, stating the state of Berlin does not submit to extortion. Multiple task forces were activated including the State Criminal Police, public prosecutor's office, and federal security agencies. The stolen data was published on the dark web on September 4-5, 2026 after the ransom deadline expired. The breach occurred 15 days before Berlin's House of Representatives election (September 20, 2026); while election infrastructure was confirmed uncompromised, the BSI warned of potential hack-and-leak operations. Rhysida has claimed approximately 280-295+ victims globally since 2023, primarily targeting education (~35%), healthcare, government, manufacturing, and technology sectors. Notable prior victims include the Chilean Army (May 2023, ~360,000 documents leaked), Prospect Medical Holdings (August 2023, 16+ hospitals, 1.3M+ affected), the British Library (October 2023, ~600GB data exfiltrated), and Lurie Children's Hospital (January 2024, ~776,000 affected).

## MITRE ATT&CK

- T1588.002 Tool
- T1078 Valid Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.009 Command and Scripting Interpreter: Cloud API
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1055.002 Process Injection: Portable Executable Injection
- T1685.005 Clear Windows Event Logs
- T1553.002 Subvert Trust Controls: Code Signing
- T1036 Masquerading
- T1003.003 OS Credential Dumping: NTDS
- T1087.002 Account Discovery: Domain Account
- T1069.002 Permission Groups Discovery: Domain Groups
- T1482 Domain Trust Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1219 Remote Access Tools
- T1530 Data from Cloud Storage
- T1572 Protocol Tunneling
- T1657 Financial Theft
- T1490 Inhibit System Recovery

## Sources

- [Rhysida in Germany — From an Early Ransomware Payload to the 2026 Stuttgart and Berlin Threat](https://malware.news/t/rhysida-in-germany-from-an-early-ransomware-payload-to-the-2026-stuttgart-and-berlin-threat/125374)
- [Berlin confirms data theft after Rhysida ransomware attack claims](https://www.bleepingcomputer.com/news/security/berlin-confirms-data-theft-after-rhysida-ransomware-attack-claims/)
- [StopRansomware: Rhysida Ransomware (AA23-319A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a)
- [Berlin city government says it won't submit to extortion after pre-election cyberattack](https://www.reuters.com/world/berlin-city-government-says-it-wont-submit-extortion-after-pre-election-2026-08-28/)
- [Berlin launches crisis response after hackers publish stolen data](https://www.reuters.com/article/berlin-rhysida-data-published-2026/)
- [Berlin cyberattack: Hackers leak highly sensitive data across dark web](https://www.euronews.com/next/2026/09/05/berlin-cyberattack-hackers-leak-highly-sensitive-data-across-dark-web)
- [Berlin data breach: Rhysida ransomware attack explained](https://www.helpnetsecurity.com/2026/09/01/berlin-data-breach-rhysida-ransomware/)
- [Microsoft investigates Fox Tempest malware-signing-as-a-service](https://msrc.microsoft.com/blog/2026/05/fox-tempest-malware-signing-service/)
- [IBM X-Force: Vanilla Tempest threat analysis](https://securityintelligence.com/posts/vanilla-tempest-rhysida-fake-microsoft-teams/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Fortinet: Analyzing Rhysida Ransomware Intrusion](https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/rhysida-ransomware-intrusion.pdf)
- [CybelAngel: Rhysida Ransomware — TTPs, IOCs and Defence in 2026](https://cybelangel.com/blog/rhysida-ransomware-explained-ttps-iocs-and-how-to-defend-in-2026/)
- [Ransomware.live: Rhysida Leak Site Tracker](https://ransomware.live/)
- [Berlin election infrastructure secure, says Interior Senator Spranger](https://www.berlin.de/sen/inneres/presse/2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2357