Rhysida ransomware gang: We attacked the British Library

The Rhysida ransomware accumulation says it's abaft the awful confusing October cyberattack on the British Library, aperture a atom of baseborn abstracts in the process.

A low-res angel aggregate to its aperture armpit appears to appearance a drop of authorization scans, alternating with added documents, some of which affectation the architecture of HMRC application documents.

Rhysida started an arrangement for the baseborn abstracts with a borderline for bids catastrophe aloof afore 0800 UTC on November 27. The abyss said there will be alone one single-party champ that will be the sole almsman of the baseborn data. The starting bid has been set at 20 Bitcoin – almost $745,000.

"With aloof 7 canicule on the clock, appropriate the befalling to bid on exclusive, unique, and absorbing data," Rhysida's bulletin on its website states. "Open your wallets and be accessible to buy absolute data. We advertise alone to one hand, no reselling, you will be the alone owner."

It goes after adage that any almsman has no way of alive this and if Rhysida is absolutely abaft the attack, it may accumulate absolute backups.

The Register approached the British Library for animadversion but it did not reply.

The British Library accepted a major IT outage at the end of October, attributable to a cybersecurity issue. It accepted the adventure to be ransomware in attributes on November 14, but Rhysida's affirmation alone accustomed this morning, Monday November 20.

The disruption acquired by the advance charcoal significant. When the advance was aboriginal confirmed, the library's acclaimed red brick armpit in London's St Pancras was operating on a cash-only base while cyberbanking payments were down. Wireless internet connectivity for visitors was additionally unavailable, and adjustment accumulating accessories were limited.

The website charcoal bottomward at the time of writing, as it has been for weeks.

Regular updates accept been provided via the library's X anniversary and a abstracted website, with casework still experiencing outages and disruption.

Responding to a catechism via amusing media apropos abeyant abstracts theft, the British Library said on November 15 that it still wasn't acquainted of the abounding admeasurement of the attack. 

"We're currently alone able to affirm which casework are still accessible but we're alive to accept and boldness the bearings as bound as possible, and to restore our added services," it said.

"We'll allotment updates on how this may affect our users as anon as we can. We're absolutely apologetic for any aggravation this has caused."

Rhysida's claims of actuality abaft the advance appear weeks afterwards the British Library aboriginal accepted the incident, and one anniversary afterwards it was accepted as ransomware – an adumbration that negotiations may accept access down.

"Ransomware attacks artlessly appear with a agreement appearance anon afterwards the advance which can booty time to acquisition the candied spot," Jake Moore, all-around cybersecurity able at ESET, told The Register. 

"If payments are to be advised by the victim, this difficult aeon can booty canicule afore added capacity are released. The victim parties generally accumulate as abundant of their attacks beneath wraps but the bent accumulation will appetite to bound affirmation responsibility.

"When a accumulation leaves it some time to affirmation their crimes, it can usually beggarly that such negotiations accept been activity aback and alternating angry for the appropriate amount from both sides. Seen as a [ransomware-as-a-service] model, Rhysida are acceptable to have not been paid the ransom they accept assuredly accepted and are now blame out the abutting appearance of the advance by aggressive the absolution of data."

Rhysida activation authorities

The US' Cybersecurity and Infrastructure Security Agency (CISA) appear an advising on November 15 to advance acquaintance of the ransomware ache which has been opportunistically targeting organizations back May 2023.

Primarily targeting the education, healthcare, manufacturing, advice technology, and government sectors, Rhysida is accepted for accepting acceptance to victims via old vulnerabilities like ZeroLogon, and application phishing and baseborn accreditation to accredit to VPNs of organizations that abridgement MFA by default.

• Cybersecurity snafu sends British Library aback to the Dark Ages
• Internet Archive justifies its all-inclusive 'copyright infringing' National Emergency Library of 1.4 actor books by pointing out that libraries are closed
• Textbook publishers sue adumbration library LibGen for absorb infringement
• Your countersign hygiene charcoal atrocious, says NordPass

Some aegis advisers accept linked Rhysida's action to groups like Vice Society, acquainted similarities in the approach and techniques in Rhysida-linked attacks. 

Rhysida is anticipation to be a ransomware-as-a-service (RaaS) accumulation in its own right, and Vice Society – believed to be abaft above attacks like the one on the LA Unified School District – may be application its kit, advisers accept theorized.

It operates on a bifold extortion model, as appears to be apparent by the British Library attack, and the accumulation tends to use active off the acreage techniques – application pre-loaded admin accoutrement to alloy in with archetypal arrangement traffic. ®