Loading threat actor…
Pysa, also known as Mespinoza and derived from the phrase “Protect Your System Amigo,” is a human-operated ransomware operation active since 2019 and prominent from early 2020 onward. The group is financially motivated and is known for big-game hunting against high-value organizations. It has been associated with double extortion, stealing sensitive data before encrypting systems and then threatening public disclosure or sale of the stolen information to increase pressure on victims. Pysa has operated a leak site for this purpose. Pysa has targeted organizations across multiple countries and sectors, with especially notable activity against education and healthcare, including during the COVID-19 period. Additional victim sectors reported for Pysa include government, utilities, transportation, construction, business services, food and agriculture, real estate, and engineering. French authorities reported multiple incidents affecting organizations in France, including local government entities. Intrusions attributed to Pysa have commonly involved manual post-compromise activity rather than self-propagation. Reported initial access methods include exploitation or abuse of Remote Desktop Protocol and phishing, including efforts to harvest RDP credentials. Observed tradecraft includes brute-force and password-spraying activity against management consoles and Active Directory accounts, credential theft, unauthorized RDP access to domain controllers, and extensive use of PowerShell and batch scripts. The operators have also used common administrative and dual-use tooling such as PsExec, PowerShell Empire, Cobalt Strike, WinSCP, Chisel, and network scanning utilities to support discovery, lateral movement, tunneling, deployment, and exfiltration. Pysa’s operators have been observed prioritizing domain controllers and Exchange servers, using stolen administrative credentials to expand access and deploy ransomware broadly. Data theft is a core part of the operation. The group has used scripted searches for high-value information including financial records, tax and payroll data, credentials, personal information, student records, and other sensitive internal material, then exfiltrated selected data to attacker-controlled infrastructure or cloud storage before encryption. The ransomware itself has been described in multiple variants and implementations, including PowerShell-based and Windows PE samples. Reported behaviors include enumerating fixed drives, selectively encrypting portions of files with AES and protecting per-file material with RSA, appending attacker-chosen extensions including .pysa in some campaigns, creating ransom notes, terminating services and processes that could interfere with encryption, changing local account passwords in at least some intrusions, and deleting shadow copies or otherwise inhibiting recovery. Investigators have not identified cryptographic flaws enabling reliable free decryption. Pysa is best understood as a financially motivated ransomware group centered on data theft, network-wide manual deployment, and high-pressure extortion against large organizations. Known aliases include Mespinoza and PYSA.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
40 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted a ransomware attack against Assured Imaging, encrypting and stealing patient data.
Conducted a ransomware attack against Assured Imaging, encrypting and stealing patient data.
Ransomware and multi-extortion operations targeting high-value organizations, especially healthcare and education, using RDP access, phishing, LOLBins, COTS tools, lateral movement, data exfiltration, and file encryption.
Human-operated ransomware conducting double-extortion attacks, exfiltrating victim data before encrypting files and threatening to leak or sell stolen data if ransom is not paid.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.