Rhysida in Germany - From an Early Ransomware Payload to the 2026 Stuttgart and Berlin Threat…
Brief
Rhysida in Germany - From an Early Ransomware Payload to the 2026 Stuttgart and Berlin Threat Landscape
Technical analysis, threat profiling, and hunting opportunities for the Vanilla Tempest / Rhysida ecosystem
In May 2026, Rhysida listed the city of Stuttgart on its data-leak site and demanded 5 BTC. Three months later, Berlin disclosed a significantly more serious compromise of parts of its state administration, with confirmed data exfiltration occurring before affected systems were disconnected from the Berlin state network. The technical details publicly available for the two incidents are very different.
Stuttgart initially stated that it had no evidence confirming a cyber incident. The Rhysida leak-site entry therefore has to be treated as an attacker claim rather than proof of a particular intrusion chain.