Rhysida Ransomware Hits Berlin State Network as City Refuses to Pay

Berlin's state government confirmed on August 29, 2026 that it is being extorted following the compromise of the city's state administrative network, and said it will not pay. Forensic work traced data leaving the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and August 12, 2026. This analysis draws on reporting from The Hacker News.

"The state of Berlin is being blackmailed," Governing Mayor Kai Wegner said after a special Senate session at the Rotes Rathaus.

The department first reported an outflow on August 7. It was not cut off from the network until August 14, seven days later. Berlin disclosed the incident publicly on August 17, said both affected departments had been isolated since the previous Friday, and reconnected all Senate departments on August 23. Housing benefit applications and payments were unavailable while those departments sat offline.

Berlin has published no figure for how much data left the network. The only itemized count comes from the attackers: a Rhysida leak-site entry titled "Berlin, Germany," indexed on August 28, claiming 5.79 terabytes across roughly 1.44 million files, plus personal information on 12,076 individuals. The largest single category is 124,823 maps and geodata files. Der Spiegel named Rhysida citing the darknet post and security sources involved in the response, though the Senate Chancellery itself has identified no group.

Rhysida is not a new name. The same joint CISA, FBI, and MS-ISAC advisory that documents its tradecraft notes open-source reporting of similarities between the actors deploying Rhysida and Vice Society, which Microsoft tracks as Storm-0832. A leak-site monitoring service listed 280 Rhysida victims as of August 29, nine of them in Germany, including the Stuttgart city administration in May 2026.

If your organization contracts with municipal or regional government, this matters directly. Public-sector networks hold supplier records, contract terms, and correspondence from private firms, and geodata and administrative files pulled from a state network can expose the companies working alongside it. Berlin's refusal to pay also sets a reference point your own leadership may be asked about.

Who Operates Rhysida and How the Group Works

Rhysida is a double extortion operation: the group steals data before encrypting it, then publishes the victim on a darknet leak site to pressure payment. A leak-site monitoring service listed 280 Rhysida victims as of August 29, nine of them in Germany.

Those German entries include the Stuttgart city administration in May 2026 and the aid organization Welthungerhilfe in June 2025. The same listings include the Port of Seattle, operator of Seattle-Tacoma International Airport, indexed in September 2024. The pattern across those names is public administration, non-profit, and transport infrastructure, organizations that run essential services and hold large volumes of citizen and staff records.

The group's posting behaviour is worth understanding on its own. Leak-site entries itemize what the operators claim to hold, breaking the haul into file categories with counts attached, and they sometimes name only a city or country rather than the specific department or subsidiary breached. For a public body, that means the first public accounting of an incident may come from the attacker, and it may describe a scope broader than what forensics has actually confirmed.

CISA, the FBI, and MS-ISAC published a joint advisory on Rhysida in November 2023 documenting three initial access routes:

• Valid accounts on external-facing remote services (MITRE T1078 combined with T1133), where operators authenticate to internal VPN access points using compromised credentials. The advisory specifically notes this at organizations that do not have multi-factor authentication enabled by default, so a stolen username and password is enough to produce a session that looks like a legitimate remote worker in your VPN logs.
• Zerologon, CVE-2020-1472, an elevation of privilege flaw in Microsoft's Netlogon Remote Protocol that Microsoft patched on August 11, 2020. An unpatched domain controller lets an attacker move from a foothold to domain-level control, which is the step that turns a single compromised endpoint into access across the estate.
• Phishing (T1566), which the agencies record as a route that has succeeded against victim networks.

Three distinct entry paths matter for how you plan detection. Intrusions branded as Rhysida do not follow one fixed sequence, so the indicators from one published incident, whether that is a phishing lure or a Netlogon exploitation attempt, will not necessarily match the next. Different operators working under the same name arrive by different doors and move at different speeds, which is why dwell time between first access and encryption varies from case to case.

The advisory also records open-source reporting of similarities between Rhysida deployments and Vice Society, the group Microsoft tracks as Storm-0832. Check Point set out that overlap in 2023. Vice Society was known for heavy targeting of public-sector and education victims, and the tooling and targeting similarities suggest continuity in tradecraft rather than a wholly new operation appearing in 2023.

On the extortion side, the advisory states plainly that the "FBI and CISA do not encourage paying ransom," on the grounds that payment does not guarantee recovery of files and may encourage the actors to hit further organizations. That guidance sits behind refusal decisions in cases like this one: paying resolves neither the exfiltration nor the publication threat, since the data has already left the network.

CVE-2020-1472 (Zerologon) in the Rhysida Attack Chain

CVE-2020-1472 is an elevation of privilege flaw in Microsoft's Netlogon Remote Protocol, the service Windows domain controllers use to authenticate machine accounts. Microsoft patched it on August 11, 2020. Three years later, CISA, the FBI and MS-ISAC still listed it in their November 2023 joint advisory as one of three documented routes Rhysida operators use to get into and move through victim networks, alongside phishing and valid credentials on internet-facing VPN gateways at organizations without MFA enabled by default.

The mechanics are unusually direct for a critical bug. An attacker with network access to a domain controller, holding no credentials at all, can abuse the Netlogon authentication exchange to reset the domain controller's own machine account password to an empty value. In practice, an intruder who reached one unremarkable workstation now controls account creation, group membership and Kerberos ticket issuance across every system joined to that domain.

For Rhysida, that position is the pivot point rather than the objective. With domain-level rights established, operators dump credentials from memory and the directory itself (T1003), then move between hosts using tooling that looks like administration: Remote Desktop sessions (T1021.001), commercial remote-access agents, and PowerShell and built-in Windows utilities that generate no new binaries for an endpoint agent to flag (T1059.001). Living-off-the-land activity of this kind is the reason victim organizations frequently reconstruct the intrusion only after encryption, because the individual commands are indistinguishable from a busy IT team's normal Tuesday.

Defense evasion follows the same logic. Operators disable or degrade endpoint protection and clear or thin out logs (T1562.001), which limits how far back responders can reconstruct activity. Files are then collected into staging directories on a small number of internal hosts (T1074) before being pushed out over encrypted channels, which is the phase that produces the terabyte-scale claims later posted to leak infrastructure. Encryption (T1486) comes last, after the data that carries the extortion leverage is already gone.

The age of the flaw is the part worth sitting with. Zerologon has been patched for six years, and its continued appearance in federal advisories points at a specific failure mode: domain controllers that were never patched, controllers rebuilt from older images, and environments where administrators applied the August 2020 update but never completed remediation by moving Netlogon into enforcement mode. Partial remediation of this kind reads as "patched" on a compliance report while the vulnerable authentication path stays open.

The exploitation leaves distinctive artifacts. Netlogon authentication from a host that has no business talking to a domain controller in that way is the first. Event ID 4742, recording a change to a computer account, is the second, and a machine account password change for the domain controller itself is not routine administrative noise. Unusual activity on the DC generally, such as new local accounts, unexpected service installations or credential access from an account that has never touched that system, rounds out the picture.

Rhysida's operators authenticate to internal VPN access points with compromised valid credentials, notably at organizations lacking multi-factor authentication enabled by default, per the CISA, FBI and MS-ISAC advisory.

If your domain controllers still run in Netlogon compatibility mode, the exposure is the same one documented in 2020, and the attack requires no credentials to begin.

Operational and Organizations Consequences of Refusing to Pay

Refusing the demand means the stolen data gets published. Rhysida's entry for Berlin lists no ransom figure at all, which tells you the negotiation never reached a price, and the claimed haul (5.79 terabytes across roughly 1.44 million files, plus personal information on 12,076 individuals) becomes the leverage instead. If you face the same choice, the decision is rarely about the number on the ransom note.

Paying would not have changed the exposure math. CISA and the FBI state plainly that they do not encourage paying ransom because payment does not guarantee recovery and may embolden adversaries to target further organizations. A decryption key restores files, and it does nothing about copies already held by the operators and their affiliates.

Your recovery timeline is set by your restoration capability, not by the attacker. Berlin isolated both affected departments and did not reconnect all Senate departments until August 23, and housing benefit applications and payments were unavailable for the duration. In a public authority that translates into residents who cannot file or receive a payment they depend on, with no commercial alternative to switch to.

The composition of the stolen set drives everything that follows. The leak-site post breaks the data into eleven categories, the largest being 124,823 maps and geodata files, which together account for only about a quarter of the claimed file count. If your own forensics cannot enumerate what left with that level of granularity, you cannot scope notification, and your legal team ends up assuming the worst case.

That gap is visible in Berlin's own position. The Senate Chancellery has said personal or other non-public data cannot be excluded from what was taken, scope and content are still being examined, and as of August 29 neither of the Senate's two releases carried guidance for people whose records may be in the set. For your organization, the practical consequence is that affected individuals cannot take any protective step until you tell them what to protect against.

Under the GDPR, a German public authority carries notification duties to both its supervisory authority and, where the risk to individuals is high, to the individuals themselves. Berlin's state data protection commissioner and the Federal Office for Information Security are being kept informed on a continuing basis, and the commissioner had issued no public statement as of August 29. Expect the regulatory relationship to outlast the incident response by months.

Payment also carries its own legal weight. Sending funds to a ransomware operation raises sanctions screening and anti-money-laundering questions for your finance and legal functions, and for a body spending public money, any payment invites parliamentary and audit scrutiny. Those obligations do not disappear because your systems are down.

For your board, the useful framing is that the ransom was never the cost driver. The spend sits in forensics, rebuilding from backups, extended service outages, notification at scale, legal advice, and regulator engagement, and none of those lines shrink if you pay.

The reputational element is different in the public sector. Berlin's incident landed weeks before the September 20 Abgeordnetenhaus election, and Interior Senator Iris Spranger stated that no data left the areas relevant to the conduct of that election and that her security officers regard the election environment as secure. Political scrutiny of a government breach concentrates on questions of competence and disclosure timing rather than customer churn.

Remediation Steps for Zerologon and Rhysida Exposure

Start with your domain controllers. Confirm every one of them carries the Netlogon patch and that the secure channel enforcement mode is actually turned on rather than left in the earlier compatibility setting that allowed vulnerable machine account connections to keep working. A patched controller running in compatibility mode still accepts the insecure authentication that made Zerologon useful to attackers, and that gap is invisible in a standard patch report.

Then hunt for evidence that someone already used it. Pull Event ID 4742 (computer account changed) from your domain controller security logs and look for machine account password changes that no administrator or scheduled process initiated, particularly changes to the domain controller's own computer account. Pair that with Netlogon service warnings about denied or allowed vulnerable connections. If either turns up, treat the domain as compromised and reset the krbtgt account twice, waiting for full replication between the two resets so existing Kerberos tickets, including any forged ones, stop working.

Enforce MFA on every VPN and remote access account before you do anything else on the identity side. That includes contractor accounts, break-glass accounts, and any service account that has been quietly granted remote login. Rhysida's operators authenticate with valid stolen credentials, so a VPN gateway that accepts a username and password alone gives them the same access your staff have, and nothing in the logs looks unusual. In environments Capstone manages, Adlumin watches authentication behavior across managed environments and surfaces logins that break a user's normal pattern, which is often the only signal that credentials have changed hands.

Over the next few weeks, work through the accounts an intruder would use to move sideways:

• Rotate service account and machine account credentials, starting with anything holding domain admin or backup operator rights, and document which application each one supports before you change it.
• Restrict RDP to jump hosts with logging, and block direct RDP from workstation subnets to servers.
• Segment domain controllers into their own management network so that a compromised file server cannot reach them on administrative ports.
• Run a real test restore from an offline, immutable backup copy and time it. A backup you have never restored is an assumption, not a recovery capability.

Longer term, set a written patch SLA for domain controllers and internet-facing systems with a defined maximum window, and report against it monthly. The Netlogon flaw sat in advisories as an active intrusion route for years after a fix existed, which happens when patching is measured by intent instead of by completion dates on specific hosts.

Deploy endpoint detection and response tuned for credential dumping against LSASS and for encoded or remote PowerShell execution, and alert on attempts to disable or uninstall the agent itself. These are the behaviors that appear between initial access and the point where data starts leaving your network, which is the window Berlin's timeline shows can run for days.

Finally, write down your ransom decision policy before you need it. Decide now who authorizes a payment discussion, who contacts law enforcement and your data protection authority, and what your public notification looks like for affected individuals. Berlin's departments were isolated within a week of the first reported outflow, and the organizations that recover fastest are the ones that already know who makes that call.

Key Takeaways for Defenders

The route documented for this operator into networks like Berlin's includes a Microsoft Netlogon flaw fixed in August 2020. Nothing in that chain required novel capability. It required a domain controller somewhere that was never confirmed to be both patched and enforcing the secure behavior the patch enables.

So the single action worth doing first is verification, not remediation planning. Walk your domain controller inventory and confirm, per host, that the Netlogon fix is present and enforcement is active. Then confirm your backups restore a working environment, because Berlin's housing benefit applications and payments stopped while two Senate departments sat off the network from mid-August until the August 23 reconnection. That outage is what recovery capability actually buys you.

The second takeaway is about scope. Interior Senator Iris Spranger could state that no data left the areas relevant to the September 20 Abgeordnetenhaus election because someone had mapped which systems held what. If you cannot draw that boundary for your own crown-jewel data sets, you will spend the first week of an incident unable to answer the questions your regulators and customers ask first.

Third, extortion is not the only outcome that costs you. Manchester Airports Group confirmed on August 27 that a third party took email addresses, phone numbers, vehicle registrations and postcodes tied to car park, lounge, Fast Track and in-airport WiFi bookings, from a system distinct from MAG itself. No encryption, no ransom note, and the company still suspended its Manage My Booking service and routed 72-hour changes through a phone line.

Check your domain controllers this week.