All Threat Groups
ID: pysa
Monitored (Active Archive)
308 Victims Disclosed
Mespinoza Pysa Ransomware Mespinoza Ransomware
RSS Feed
Pysa Syndicate Dossier
First Intercepted
2020-07-01
Latest Disclosure
2022-09-20
Victim Velocity
1.0 / claim
Threat Profile & Operational Narrative
Emerging in late 2019 as Mespinoza before rebranding to PYSA ('Protect Your System Amigo'), this syndicate was a prolific double-extortion threat that targeted organizations globally until ceasing operations in early 2022. The ransomware payload was developed in C++ (with supporting Go backdoors such as ChaChi and Gasket) utilizing AES-CBC and RSA algorithms to encrypt Windows and Linux systems. Initial access was systematically achieved through brute-forcing exposed Remote Desktop Protocol (RDP) connections and phishing lures, with attacks disproportionately targeting higher education, healthcare, and public sector organizations.
Tactics, Techniques & Procedures (MITRE ATT&CK)
T1110: Brute Force T1078: Valid Accounts T1021.001: Remote Desktop Protocol T1059.001: PowerShell T1059.003: Windows Command Shell T1003.001: LSASS Memory T1486: Data Encrypted for Impact T1490: Inhibit System Recovery T1562.001: Disable or Modify Tools T1567.002: Exfiltration to Cloud Storage
Targeted Sectors & Geographies
Construction (1)
US (1)
Known Dark Web Infrastructure & Mirrors
pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion
OFFLINE
Disclosed Victims & Incident Archive (308)
| Disclosed | Victim Organization | Sector | Country |
|---|---|---|---|
| 2022-09-20 | ΤÎΧÎÎÎÎÎÎÎÎ Î ÎÎÎÎ ÎΣΤÎÎÎÎ ÎΥΠΡÎÎ¥ | General | -- |
| 2021-12-06 | CHR Solutions | General | -- |
| 2021-11-08 | The Skinners Kent Academy | General | -- |
| 2021-11-08 | Kent County Council | General | -- |
| 2021-11-08 | Rusty Hardin & Associates | General | -- |
| 2021-11-08 | R.E. Pedrotti Co. | General | -- |
| 2021-11-08 | UEMOA | General | -- |
| 2021-11-08 | Skatetown | General | -- |
| 2021-11-08 | CHRYSO | General | -- |
| 2021-11-08 | itimCloud | General | -- |
| 2021-11-08 | Bayonet | General | -- |
| 2021-11-08 | Fly Arik Air | General | -- |
| 2021-11-08 | Las Vegas Cancer Center | General | -- |
| 2021-11-08 | CarpenterProjects | General | -- |
| 2021-11-08 | Westmont Helena | General | -- |
| 2021-11-08 | Woodchurch High School | General | -- |
| 2021-11-08 | Emkay Food Sales | General | -- |
| 2021-11-08 | Premier Energy | General | -- |
| 2021-11-08 | Schmincke Künstlerfarben | General | -- |
| 2021-11-08 | Stratford Land | General | -- |
| 2021-11-08 | Dr Schneider | General | -- |
| 2021-11-08 | Rockbridge and Bath County | General | -- |
| 2021-11-08 | Nordic Pharma | General | -- |
| 2021-11-08 | The Leschaco Group | General | -- |
| 2021-11-08 | Eason Horticultural Resources | General | -- |
| 2021-11-08 | SWL | General | -- |
| 2021-11-08 | Lucton School | General | -- |
| 2021-11-08 | Hickory Veterinary Hospital | General | -- |
| 2021-11-08 | Westvale Primary School | General | -- |
| 2021-11-08 | Property Damage Restoration | General | -- |
| 2021-11-08 | Garner Dental Group | General | -- |
| 2021-11-08 | MVS Mailers | General | -- |
| 2021-11-08 | EHS | General | -- |
| 2021-11-08 | Comstock Johnson Architects | General | -- |
| 2021-11-08 | La Bodega | General | -- |
| 2021-11-08 | Gulfport MS | General | -- |
| 2021-11-08 | Pitts Baptist Church | General | -- |
| 2021-11-08 | Emi Jay | General | -- |
| 2021-11-08 | Niemi Bil i Luleå | General | -- |
| 2021-11-08 | Department of Justice and Constitutional Development | General | -- |
| 2021-11-08 | MPRL E&P | General | -- |
| 2021-11-08 | Capitol Beauty School | General | -- |
| 2021-11-08 | Bryant Industrial Services | General | -- |
| 2021-11-08 | Alternatives, Inc. | General | -- |
| 2021-11-08 | Family Dental Health | General | -- |
| 2021-11-08 | Community Brands | General | -- |
| 2021-11-08 | Vision Source | General | -- |
| 2021-11-08 | AECOM | Construction | US |
| 2021-11-08 | Jalasoft | General | -- |
| 2021-11-08 | Astera Software | General | -- |
| 2021-11-08 | Thunderbird Adventist Academy | General | -- |
| 2021-11-08 | Raj Transport Inc. | General | -- |
| 2021-11-08 | Metaenergia | General | -- |
| 2021-11-08 | Florida Heart Associates | General | -- |
| 2021-11-08 | Family Dentist Newbury | General | -- |
| 2021-11-08 | ProActive Works | General | -- |
| 2021-11-08 | Diputación de Segovia | General | -- |
| 2021-11-08 | City of Bridgeport, WV | General | -- |
| 2021-11-08 | Ferrara | General | -- |
| 2021-11-08 | Universitat Autònoma de Barcelona | General | -- |
| 2021-10-25 | Höerskool Labori Paarl | General | -- |
| 2021-10-25 | Cenikor | General | -- |
| 2021-10-25 | Suntide Commercial Realty | General | -- |
| 2021-10-25 | Motor Appliance Corporation | General | -- |
| 2021-10-22 | Townley Grammar School | General | -- |
| 2021-10-22 | Ruskin Community High School | General | -- |
| 2021-10-22 | Weiss Properties | General | -- |
| 2021-10-18 | Lesk Engineering | General | -- |
| 2021-10-18 | Our Lady's Abingdon | General | -- |
| 2021-10-18 | Western Urethane | General | -- |
| 2021-10-18 | QPharma | General | -- |
| 2021-10-18 | Price Davis LLC | General | -- |
| 2021-10-18 | Campus Sacre Coeur Wien Gymnasium | General | -- |
| 2021-10-18 | CreateInfor | General | -- |
| 2021-10-18 | InfoSync IT Solutions | General | -- |
| 2021-10-18 | Hall Technologies Inc | General | -- |
| 2021-10-04 | Consolidated High School District 230 | General | -- |
| 2021-10-04 | Santélys | General | -- |
| 2021-10-04 | Instituto Mixto de Ayuda Social | General | -- |
| 2021-10-04 | Ardagh Group | General | -- |
| 2021-10-04 | ITS, Inc. | General | -- |
| 2021-10-04 | St Benet Biscop | General | -- |
| 2021-10-04 | Jurysync | General | -- |
| 2021-10-04 | Adore Fashions | General | -- |
| 2021-10-04 | HMCC | General | -- |
| 2021-10-04 | Associated Solutions | General | -- |
| 2021-10-04 | Ocean View Nursing & Rehabilitation | General | -- |
| 2021-09-13 | Betson Enterprises | General | -- |
| 2021-09-13 | One Community Health | General | -- |
| 2021-09-13 | Jesse Engineering Co | General | -- |
| 2021-09-13 | Grupo SAN | General | -- |
| 2021-09-13 | Spartanburg & Pelham OB-GYN | General | -- |
| 2021-09-13 | Haverhill High School | General | -- |
| 2021-09-13 | Woodlake Unified | General | -- |
| 2021-09-13 | HABI | General | -- |
| 2021-09-10 | Drug Alcohol Testing | General | -- |
| 2021-09-09 | Sacschool | General | -- |
| 2021-09-09 | Liberty Linehaul | General | -- |
| 2021-09-09 | Faic | General | -- |
| 2021-09-09 | Diamond Box | General | -- |
Showing 100 most recent disclosures of 308 total records. Use the Live Feed or API for complete records.