Loading story…
U.S. and European authorities warned that the PYSA ransomware group, also tracked as Mespinoza, was conducting double-extortion attacks against education and government organizations after stealing data and then encrypting Windows and Linux systems. The FBI said incidents affected higher education, K-12 schools, and seminaries across 12 U.S. states and the United Kingdom, while France's CERT-FR reported related intrusions against local government authorities. Stolen information included employment records, personally identifiable information, and payroll tax data, with victims pressured through ransom notes and threats to publish data on Tor-based leak sites.
Investigations and technical analyses showed the operators commonly gained initial access through compromised or brute-forced RDP credentials and phishing, then expanded access with reconnaissance and post-exploitation tools including Advanced IP Scanner, Advanced Port Scanner, PowerShell Empire, Koadic, Mimikatz, PsExec, Cobalt Strike, WinSCP, Chisel, and MEGA. The malware appended extensions such as .pysa, .locked, and .newversion, used AES encryption with RSA-protected keys, terminated services and security tools to improve encryption success, and in some cases changed local account passwords or modified Windows legal notice settings to display ransom demands. Researchers and law enforcement said the campaign disproportionately targeted high-value organizations, especially education, healthcare, and government entities, and urged mitigations including MFA, RDP hardening, segmentation, patching, least privilege, backups, and user awareness training.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
SentinelOne reported that Pysa's victim leak blog was offline as of early April 2022. The same analysis documented tactics observed across two investigated Pysa campaigns, including RDP access, password spraying, PsExec, Chisel, and Mega exfiltration.
Cyble published a technical analysis stating that Pysa had more than 190 victims worldwide and identifying the United States, United Kingdom, Canada, Spain, and Brazil as the most affected countries. The report also documented the group's leak site, ransom behavior, and indicators of compromise.
A Pysa ransomware sample later analyzed by Cyble was compiled on this date. The sample was described as an x86 Windows PE written in C/C++ that appends the .pysa extension and uses AES-256 encryption.
BleepingComputer reported on a PowerShell script used by the Pysa ransomware operation to scan compromised servers for folders matching 123 predefined keywords and upload matching files to an attacker-controlled server. The disclosure showed how Pysa prioritized financial, personal, credential, tax, student, and sensitive internal data to support ransom valuation and leak extortion.
BlackBerry published research on a new GoLang remote access trojan called ChaChi associated with Pysa-related intrusions. The report added technical detail on tooling used in the campaign, expanding public understanding of the group's post-compromise capabilities.
The FBI, coordinated with DHS-CISA, issued Alert Number CP-000142-MW warning of increased Pysa ransomware attacks. The alert said education institutions in 12 U.S. states and the United Kingdom were being increasingly targeted in double-extortion attacks.
CERT-FR issued an alert warning that a Mespinoza/Pysa ransomware gang was targeting French organizations, especially local government authorities. The alert described the operation as human-operated big-game hunting and noted a newer variant using the .newversion extension.
The FBI said it had become aware of Pysa attacks against U.S. and foreign government entities, educational institutions, private companies, and the healthcare sector starting in March 2020. Later reporting also described increased attacks from that period against U.S. and Canadian institutions.
ANSSI published technical findings from investigations into ransomware attacks on French local authorities, describing Windows and Python-based Pysa variants, their ransom notes, self-deletion behavior, and registry changes. The report also documented a separate PowerShell-based ransomware using the .newversion extension and overlapping ProtonMail contacts, along with intrusion tooling such as Mimikatz, PsExec, Empire, and a Go-based RAT.
CERT-FR reported receiving multiple infection reports involving the Pysa gang in France, particularly affecting local government authorities. The incidents involved brute-force activity, unauthorized RDP access, script deployment, credential theft, and antivirus disabling.
ANSSI reported that the Mespinoza ransomware family had been used since at least October 2018, establishing an explicit earliest known timeframe for the precursor later associated with Pysa. The report identified Mespinoza as the primary ransomware used in the analyzed attacks.
A January 2021 Pysa variant used the ransom note filename Readme.README.txt. This marked a documented evolution from earlier Readme.README note naming.
A new version of Mespinoza appeared using the .pysa extension, leading to the ransomware also being referred to as Pysa. Reporting places this transition in late 2019 to early 2020.
Mespinoza ransomware was first observed affecting victims, with early variants encrypting files using the .locked extension. Later reporting identifies this as the precursor to Pysa.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
cybereason.com
Open sourcesentinelone.com
Open sourceblog.cyble.com
Open sourcebleepingcomputer.com
Open sourcecert.ssi.gouv.fr
Open sourceic3.gov
Open sourcevirustotal.com
Open sourcecert.ssi.gouv.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI, CISA, and MS-ISAC issued a joint **#StopRansomware** advisory warning that the **Vice Society** intrusion and extortion group has disproportionately targeted the education sector, particularly **K-12 schools**. The group has caused network outages, delayed exams, canceled school days, and theft of student and staff personal information. Investigators said Vice Society has been active since at least summer 2021 and uses **double extortion**, stealing data before encrypting systems and threatening to publish it if victims refuse to pay. Authorities said Vice Society does not depend on a single ransomware strain, instead deploying variants including **Hello Kitty/Five Hands** and **Zeppelin**. The group has gained access through exploitation of internet-facing applications and compromised credentials, then moved laterally using tools such as **SystemBC**, **PowerShell Empire**, and **Cobalt Strike**, while escalating privileges through **PrintNightmare** flaws `CVE-2021-1675` and `CVE-2021-34527`. The advisory included indicators of compromise such as OnionMail addresses, a Tor leak site, command-and-control IP addresses, and file hashes, and urged organizations to prioritize patching known exploited vulnerabilities, enforce phishing-resistant MFA, maintain offline immutable backups, secure RDP, segment networks, and restrict SMB and other unnecessary ports.
Jun 29, 2026
U.S. authorities warned that malicious cyber actors were actively targeting K-12 schools and other educational institutions as remote learning expanded, using ransomware, malware, phishing, DDoS attacks, and video-conference intrusions to disrupt classes and steal sensitive data. The joint FBI, CISA, and MS-ISAC advisory said schools had become targets of opportunity, with ransomware incidents rising sharply and commonly involving **data theft and extortion**; families observed in attacks included `Ryuk`, `Maze`, `Nefilim`, `AKO`, and `Sodinokibi/REvil`, while malware such as `ZeuS` and `Shlayer` also affected the sector. Separate reporting on criminal forums showed underground sellers offering remote access to compromised schools and universities in the U.S., U.K., Australia, Israel, and Germany, with listings priced from **$200 to $17,000** based on victim size and privilege level. The activity coincided with leaked credentials, exposed FTP servers, and student-data incidents tied to education and e-learning platforms, reinforcing concerns about weak remote-access security, exposed `RDP` and `SMB` services, end-of-life software, and third-party edtech risks; officials urged patching, MFA, network segmentation, offline backups, DDoS protections, tighter conferencing controls, and stronger vetting of service providers.
Aug 15, 2026
Brazilian educational institutions faced a sustained wave of cyber incidents in incident-response cases reviewed from January 2025 through June 2026, with attackers most often gaining access through **valid accounts**, exploitation of public-facing applications, insider activity, and weak patch management. High-severity cases were dominated by ransomware, particularly **DragonForce** and **LockBit 3**, and private institutions were more frequently affected than public ones. Investigators also found that outdated and unpatched systems, including Windows 10 deployments kept past end of support and unpatched Windows Server 2016 hosts, materially increased exposure. Representative intrusions showed attackers relying on common but effective techniques rather than novel tradecraft. One LockBit case involved a custom deployment built from the leaked builder and spread with **PsExec**, aligning with the well-documented abuse of Windows **service execution** for lateral movement and payload launch. Another DragonForce intrusion used **AnyDesk** and log wiping to maintain access and hinder response, while a separate insider case involved a Python **keylogger** installed on a shared machine to capture credentials. The findings underscore the need for MFA, least privilege, removal of shared accounts, tighter control of remote-access tools, stronger backups, centralized logging, longer EDR retention, and faster patching.
Aug 3, 2026