Best Collateral Hit by RHYSIDA Ransomware Attack

In an escalation of cyber threats targeting the financial sector, Best Collateral, Inc., a U.S.-based financial services firm established in 1903, has fallen victim to the Rhysida ransomware group.

The attack, disclosed on March 5, 2025, underscores the persistent vulnerabilities in critical infrastructure sectors and the evolving sophistication of ransomware operations.

Rhysida, active since May 2023, has rapidly gained notoriety for its double extortion tactics, combining data encryption with threats of public leakage to pressure victims into paying ransom in Bitcoin.

Technical Execution and Attack Vector

According to the post from DarkWebInformer, Initial forensic analysis suggests Rhysida operators exploited unpatched vulnerabilities in Best Collateral’s network infrastructure, potentially leveraging phishing campaigns or compromised credentials to gain entry.

Once inside, the attackers deployed Cobalt Strike, a penetration testing tool repurposed for lateral movement, to escalate privileges and disable security protocols.

Rhysida’s payload, a 64-bit Windows PE executable compiled with MinGW GNU, employs the LibTomCrypt library for hybrid encryption—using ChaCha20 for symmetric file encryption and RSA-OAEP for securing AES keys.

Notably, the ransomware incorporates command-line arguments such as -sr (self-removal post-encryption) and -S (scheduled task creation for persistence).

Unlike earlier variants, this iteration avoids modifying desktop wallpapers, a flawed feature in prior versions.

The group exfiltrated sensitive client data, including financial records and personally identifiable information (PII), before encrypting systems—a hallmark of their double extortion strategy.

Sector-Wide Implications and Response

The breach has raised alarms due to Best Collateral’s role in serving small businesses and families, with potential fallout including identity theft and regulatory penalties.

Rhysida’s leak site lists the company alongside recent victims like the World Council of Churches and Kaunas University, reflecting the group’s cross-sector targeting.

Cybersecurity agencies, including CISA and the FBI, have reiterated advisories first issued in November 2023, urging organizations to patch RDP vulnerabilities, enforce multi-factor authentication, and segment networks to curb lateral movement.

Mitigation Strategies and Industry Recommendations

To counter Rhysida’s TTPs, experts recommend deploying endpoint detection and response (EDR) tools to flag suspicious PsExec or PowerShell activities.

Regular audits of privileged accounts and simulated phishing exercises can reduce initial access risks. Additionally, air-gapped backups and immutable storage solutions are critical for recovery without ransom payments.

As Rhysida’s operators share infrastructure overlaps with the defunct Vice Society group, threat intelligence sharing remains vital to preempting affiliate-driven campaigns.

The attack on Best Collateral highlights the urgent need for financial institutions to adopt zero-trust architectures and conduct continuous security validation.

With Rhysida’s Linux variant now in circulation, organizations must extend defensive measures beyond traditional Windows environments.

As ransomware groups increasingly weaponize legitimate tools, proactive defense—not reactive compliance—will define resilience in 2025’s cyber landscape.

Also Read:

FOG Ransomware Group Leaks Source Code of 19 Victims on Dark Web

See more