Rhysida Ransomware Explained: TTPs, IOCs and How to Defend in 2026

Rhysida threat actors posted a leak-site entry titled simply “Berlin, Germany” on August 28, 2026. The entry claimed 5.79 terabytes of data lifted from the German capital’s state network, spanning roughly 1.44 million files. The group demanded 30 bitcoin, worth around €2 million, and set a seven-day countdown before it said it would start selling.