Attack alert: rhysida targets United Keetoowah Band of Cherokee Indians in Oklahoma - US

Introduction

On December 12, 2025, the Rhysida ransomware group claimed responsibility for a cyberattack against the United Keetoowah Band of Cherokee Indians in Oklahoma, a U.S. tribal government that manages sensitive data belonging to Native American citizens. This breach, classified as SIGNAL level according to the XC-Classify methodology, exposes a government organization with 100 to 250 employees, founded in 1950, responsible for critical services including health, social services, and tribal finances. The incident, certified on the Polygon blockchain via the XC-Audit protocol, illustrates the growing vulnerability of tribal governments to cyber threats targeting identity and medical information.

This attack comes at a time when U.S. tribal governments are becoming prime targets for cybercriminals due to their limited cybersecurity resources and the wealth of personal data they hold. The federally recognized United Keetoowah Band, based in Oklahoma, administers vital programs for its community, making any service disruption particularly critical for the Indigenous populations dependent on this infrastructure.

Analyse détaillée

The appearance of this claim on the Rhysida leak site in December 2025 confirms the group's usual modus operandi: initial compromise, exfiltration of sensitive data, and then publication on their double extortion platform. The targeted data likely includes medical records, vital statistics, financial data, and tribal administrative documents, creating a major risk of identity theft for affected citizens.

This cyberattack against tribal government infrastructure raises critical questions about the protection of Indigenous populations from digital threats. Tribal governments, often underfunded compared to federal or state administrations, represent vulnerable targets for malicious actors seeking to maximize their profits while minimizing the risk of detection.

Rhysida: Modus Operandi, History, and Victims of the Ransomware Group

Rhysida has established itself as a major player in the ransomware landscape since its emergence in May 2023. This cybercriminal collective operates using a particularly aggressive double extortion model: encryption of computer systems combined with the exfiltration and subsequent gradual release of stolen data to maximize pressure on victims. The group is distinguished by its speed of action and its ability to compromise critical infrastructure in just a few hours.

Rhysida's modus operandi relies on exploiting vulnerabilities in remote access systems, particularly through poorly secured Remote Desktop Protocol (RDP) protocols and outdated VPNs. Once initial access is gained, attackers deploy reconnaissance tools to map the network, escalate their privileges using known exploits, and then exfiltrate the data before triggering the generalized encryption. This systematic methodology allows them to compromise organizations of all sizes with formidable efficiency.

Notable victims of Rhysida include American healthcare facilities, European educational institutions, and several local governments. In August 2023, the group notably compromised Prospect Medical Holdings, exposing the data of hundreds of thousands of patients. Their preferred target remains public and parapublic sector organizations, perceived as more technically vulnerable while possessing the budgets to pay substantial ransoms.

The group uses a leak site accessible via the Tor network where they progressively publish the exfiltrated data, creating time pressure on the victims. Each publication is accompanied by a countdown and an auction price for the data, transforming extortion into a genuine illicit trade. This "data auction" approach differentiates Rhysida from other ransomware groups and attracts the attention of potential malicious buyers, multiplying the risks for victims.

Although some clues suggest links to the Vice Society ecosystem, Rhysida operates independently and continually develops its tactics. The group does not appear to follow a traditional Ransomware-as-a-Service (RaaS) model, preferring to maintain direct control over its operations. This centralized structure allows for operational consistency but also limits its scalability compared to major ransomware franchises.

United Keetoowah Band of Cherokee Indians in Oklahoma: Profile of the Tribal Government Organization

The United Keetoowah Band of Cherokee Indians in Oklahoma (UKB) is one of the three federally recognized Cherokee tribes in the United States. Officially established in 1950 following federal recognition, this tribal nation administers comprehensive government services for its citizens, including public health, education, housing, social services, and financial management. With a staff of 100 to 250 employees, the UKB operates as a truly autonomous public administration within the U.S. federal system.

Based in Oklahoma, the organization manages critical programs funded partly by the U.S. federal government and partly by its own tribal revenues. These programs include community health clinics, social welfare services, educational and cultural programs, and tribal land management. The sensitive nature of these activities involves the collection and storage of substantial volumes of personal data: electronic medical records, tribal registration information, financial data of social program beneficiaries, and confidential administrative documents.

→ Understanding the Specific Risks of the Government Sector helps contextualize the particular vulnerabilities of tribal administrations to contemporary cyber threats.

The UKB's unique position within the U.S. administrative landscape creates specific cybersecurity challenges. Unlike federal agencies, which benefit from substantial IT budgets and dedicated cybersecurity teams, tribal governments often operate with limited resources while managing comparable responsibilities. This budgetary asymmetry results in sometimes outdated technological infrastructure, inadequate backup systems, and limited staff training in cybersecurity best practices.

The UKB's importance to its community significantly amplifies the potential impact of this compromise. Tribal citizens rely directly on these services for their health, livelihoods, and family well-being. Any prolonged disruption to computer systems could block access to medical care, delay welfare payments, and disrupt essential services. This critical dependence makes tribal governments particularly attractive targets for cybercriminals engaging in extortion, knowing that the pressure to quickly restore services will be immense.

The UKB compromise is part of a disturbing trend specifically targeting American tribal nations. These organizations combine several vulnerability factors: limited cybersecurity resources, highly sensitive data, critical community dependence, and sufficient financial capacity to consider paying ransoms. This convergence of factors explains why malicious actors are intensifying their attacks against this particular segment of the government sector.

Technical Analysis: Level of Exposure and Associated Risks

The SIGNAL classification assigned by the XC-Classify methodology indicates confirmed exposure of sensitive data without precise details on the volume or exact nature of the compromised information. This level suggests that Rhysida did indeed exfiltrate data from the UKB infrastructure and publish it on their leak platform, but without an immediate mass release of the entire dataset. This phased approach is part of their extortion strategy: publishing enough information to prove the compromise while retaining the majority of the data as leverage.

Conclusion

According to our analysis of data verified on the Polygon blockchain, the incident was discovered and claimed on December 12, 2025. The exact timeline of the initial compromise remains undetermined, but Rhysida's typical modus operandi suggests an intrusion window of several days to a few weeks before the public claim. This period allows attackers to establish persistence on the network, identify critical systems, progressively exfiltrate sensitive data, and prepare the ransomware deployment.