Pysa

Family profile

Pysa, also known as Mespinoza and derived from the phrase “Protect Your System Amigo,” is a human-operated ransomware family associated with double-extortion intrusions against organizations in government, education, healthcare, and other private-sector environments. First observed as Mespinoza in 2019 and later widely tracked as Pysa, it encrypts victim data and pressures organizations by threatening to leak stolen information. The operation has been linked to campaigns against high-value targets, including local government authorities and educational institutions, and has also been reported targeting healthcare and business networks across multiple countries.

Pysa intrusions are characterized by hands-on-keyboard activity rather than self-propagation. Reported initial access methods include phishing and the use of compromised or brute-forced credentials, particularly through Remote Desktop Protocol and Active Directory accounts. Operators have used common administrative and offensive tooling for post-compromise activity, including credential theft, privilege escalation, lateral movement, and reconnaissance. Observed tradecraft includes extraction of credentials from password databases, network reconnaissance with scanning tools, use of PowerShell and PsExec for deployment, disabling or removing security products, and deletion of restore points and shadow copies to hinder recovery. Data theft is a core part of the operation’s extortion model, and operators have used scripts to identify and exfiltrate financially, legally, and operationally sensitive information before encryption.

Windows variants of Pysa have been described as implemented in C++ using hybrid AES and RSA encryption, while other observed variants have included Python- and PowerShell-based encryptors. The malware typically appends the .pysa extension to encrypted files, though other extensions have also been observed in some variants. It drops ransom notes and may write ransom text into Windows legal notice settings so the message is displayed to users. Pysa commonly avoids encrypting selected system-critical files and directories to preserve system operability long enough for ransom negotiation. Some variants create a mutex to prevent duplicate execution and use batch-script cleanup to delete the ransomware after launch. Linux encryptors associated with the operation have also been reported, particularly in the broader trend of ransomware targeting virtualized enterprise infrastructure such as ESXi environments.

Pysa is best understood as a financially motivated ransomware operation that combines credential theft, reconnaissance, exfiltration, defense evasion, and manual deployment to maximize impact on enterprise victims.

Capabilities

Brute Force
Credential Theft
Defense Evasion
Exfiltration
Lateral Movement
Reconnaissance
Scanning

Operational record

YARA rules

Leak sites

0 available

Credential Theft

Mimikatz
ProcDump
SessionGopher

Discovery Enum

ADRecon
Advanced IP Scanner
Advanced Port Scanner

Exfiltration

FileZilla
WinSCP

LOLBAS

PsExec
WMIC

Offsec

Chashell
Koadic
PowerShell Empire
PowerSploit

MITRE ATT&CK

Pysa in ATT&CK

47 distinct techniques

Techniques

47 techniques

T1059.001 PowerShell T1497 Virtualization/Sandbox Evasion T1112 Modify Registry T1016 System Network Configuration Discovery T1555 Credentials from Password Stores T1070.004 File Deletion T1036 Masquerading T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1083 File and Directory Discovery T1531 Account Access Removal T1110 Brute Force T1046 Network Service Discovery T1190 Exploit Public-Facing Application T1059 Command and Scripting Interpreter T1657 Financial Theft T1021.001 Remote Desktop Protocol T1566 Phishing T1021 Remote Services T1189 Drive-by Compromise T1562 Impair Defenses T1059.003 Windows Command Shell T1048 Exfiltration Over Alternative Protocol T1106 Native API T1041 Exfiltration Over C2 Channel T1078 Valid Accounts T1070 Indicator Removal T1204.002 Malicious File T1074 Data Staged T1133 External Remote Services T1007 System Service Discovery T1567.003 Exfiltration to Text Storage Sites T1567.002 Exfiltration to Cloud Storage T1036.005 Match Legitimate Resource Name or Location T1565 Data Manipulation T1562.001 Disable or Modify Tools T1114 Email Collection T1012 Query Registry T1135 Network Share Discovery T1120 Peripheral Device Discovery T1569.002 Service Execution T1021.002 SMB/Windows Admin Shares T1003 OS Credential Dumping T1552.001 Credentials In Files T1003.001 LSASS Memory T1059.006 Python

Reporting

Research mentioning Pysa

Aug 3

Securelist

Incident response statistics and cases at educational institutions in Brazil | Securelist

Brazilian educational institutions faced a sustained wave of cyber incidents in incident-response cases reviewed from January 2025 through June 2026, with attackers most often gaining access through valid accounts, exploitation of public-facing applications, insider activity, and weak patch management. High-severity cases were dominated by ransomware, particularly DragonForce and LockBit 3, and private institutions were more frequently affected than public ones. Investigators also found that outdated and unpatched systems, including Windows 10 deployments kept past end of support and unpatched Windows Server 2016 hosts, materially increased exposure. Representative intrusions showed attackers relying on common but effective techniques rather than novel tradecraft. One LockBit case involved a custom deployment built from the leaked builder and spread with PsExec, aligning with the well-documented abuse of Windows service execution for lateral movement and payload launch. Another DragonForce intrusion used AnyDesk and log wiping to maintain access and hinder response, while a separate insider case involved a Python keylogger installed on a shared machine to capture credentials. The findings underscore the need for MFA, least privilege, removal of shared accounts, tighter control of remote-access tools, stronger backups, centralized logging, longer EDR retention, and faster patching.

Mar 22

Sentinelone Labs Subdomain

Multi-Platform SMAUG RaaS Aims To See Off Competitors - SentinelLabs

SMAUG is a ransomware-as-a-service (RaaS) operation that advertises 64-bit payloads for Windows, Linux, and macOS, positioning itself as a multi-platform option for affiliates. The service reportedly charges a 20% affiliate fee plus a 0.2 BTC registration fee, and provides a web-based campaign builder, customizable ransom demands, offline encryption, and a "Company Mode" that allows a single decryption key to unlock multiple systems inside one targeted organization. Victims are directed to a Tor-based payment portal, while operators reportedly offer automated support for both affiliates and victims and bar attacks against CIS countries. On Windows, SMAUG uses obfuscated Go binaries that gather system details and stored browser credentials, establish persistence through Registry Run Keys consistent with MITRE ATT&CK T1547.001, and then encrypt files for impact using AES-256 with keys protected by RSA-2048, aligning with T1486 Data Encrypted for Impact tradecraft. The combination of credential collection, registry-based autostart, and hybrid cryptography reflects a mature ransomware model designed to support repeatable intrusions and broad enterprise targeting across multiple operating systems.

Mar 9

Mitre Attack Website