Rhysida in Germany - From an Early Ransomware Payload to the 2026 Stuttgart and Berlin Threat…

This report analyzes the Rhysida (Vanilla Tempest) ransomware ecosystem active in 2026, linking malvertising, trojanized installers, fraudulent code-signing (Fox Tempest), and a chain of loaders/backdoors (Endico, Broomstick/Oyster, Supper, Vidar) that led to extortion claims in Stuttgart and confirmed data exfiltration from Berlin state administration; it provides sample hashes, C2/IP indicators, ATT&CK-aligned TTPs, and prioritized detection and hunting opportunities focused on upstream behaviors before encryption.