Credential Theft
- Mimikatz
- ProcDump
- SessionGopher
Pysa
Pysa, also referred to as Mespinoza, is a ransomware family first observed in October 2019 via malspam.
Profile source: Mallory opens in a new tabPysa
Family profile
Pysa, also referred to as Mespinoza, is a ransomware family first observed in October 2019 via malspam. A newer variant appeared in December 2019 and became commonly known as Pysa because it appends the .pysa extension to encrypted files. The malware is associated with double-extortion activity, including encryption and theft of victim data, and has been linked in the provided content to the PYSA ransomware gang’s 2020 attack on Assured Imaging, where patient data was encrypted and stolen, affecting nearly 245,000 individuals. The content also notes Pysa activity impacting K-12 school districts and references a 2021 attack involving a Pysa variant that led to a HIPAA breach investigation.
Documented capabilities in the provided content include use of RSA and AES-CBC to encrypt targeted file extensions; modification of the registry key SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, including adding the ransom note; use of PowerShell scripts to deploy the ransomware; stopping antivirus services and disabling Windows Defender; deletion of shadow copies; credential extraction from the password database before file encryption; OS credential dumping with Mimikatz; brute-force attempts against a central management console and some Active Directory accounts; network reconnaissance using Advanced Port Scanner; and lateral movement via RDP connections. The malware has also been reported using PsExec to copy and execute the ransomware and executing a malicious binary named svchost.exe.
Behavioral analysis in the content states that Mespinoza/Pysa avoids encrypting certain Windows and critical operating system directories, checks removable media and shared network drives using GetDriveTypeW, looks for SQL-related processes, and runs verclsid.exe during execution. The CLSIDs observed were tied to C:\Windows\system32\SearchFolder.dll and a Microsoft SQL Server IDBProperties component. An encrypted key is appended to the end of each encrypted file. One analyzed sample did not delete Volume Shadow Copies, although other provided references state that Pysa has that functionality. Known sample hashes in the content include SHA-256 a18c85399cd1ec3f1ec85cd66ff2e97a0dcf7ccb17ecf697a5376da8eda4d327 and e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead. Ransom note contact addresses mentioned in the content include raingemaximo@protonmail.com, gareth.mckie3l@protonmail.com, aireyeric@protonmail.com, ellershaw.kiley@protonmail.com, mespinoza980@protonmail.com, alanson_street8@protonmail.com, and lambchristoffer@protonmail.com.
Operational record
1
YARA rules
1
Leak sites
0 available
Discovery Enum
- ADRecon
- Advanced IP Scanner
- Advanced Port Scanner
Exfiltration
- FileZilla
- WinSCP
LOLBAS
- PsExec
- WMIC
Offsec
- Chashell
- Koadic
- PowerShell Empire
- PowerSploit
MITRE ATT&CK
Pysa in ATT&CK
30 distinct techniquesTechniques
30 techniques T1112 Modify Registry T1046 Network Service Discovery T1016 System Network Configuration Discovery T1567.002 Exfiltration to Cloud Storage T1059.001 PowerShell T1036.005 Match Legitimate Resource Name or Location T1036 Masquerading T1562 Impair Defenses T1070.004 File Deletion T1490 Inhibit System Recovery T1555 Credentials from Password Stores T1565 Data Manipulation T1021.001 Remote Desktop Protocol T1562.001 Disable or Modify Tools T1486 Data Encrypted for Impact T1074 Data Staged T1041 Exfiltration Over C2 Channel T1114 Email Collection T1012 Query Registry T1489 Service Stop T1135 Network Share Discovery T1120 Peripheral Device Discovery T1566 Phishing T1569.002 Service Execution T1021.002 SMB/Windows Admin Shares T1003 OS Credential Dumping T1110 Brute Force T1552.001 Credentials In Files T1003.001 LSASS Memory T1059.006 Python
Reporting
Research mentioning Pysa
Aug 3
Securelist
Incident response statistics and cases at educational institutions in Brazil | Securelist
Brazilian educational institutions faced a sustained wave of cyber incidents in incident-response cases reviewed from January 2025 through June 2026, with attackers most often gaining access through valid accounts, exploitation of public-facing applications, insider activity, and weak patch management. High-severity cases were dominated by ransomware, particularly DragonForce and LockBit 3, and private institutions were more frequently affected than public ones. Investigators also found that outdated and unpatched systems, including Windows 10 deployments kept past end of support and unpatched Windows Server 2016 hosts, materially increased exposure. Representative intrusions showed attackers relying on common but effective techniques rather than novel tradecraft. One LockBit case involved a custom deployment built from the leaked builder and spread with PsExec, aligning with the well-documented abuse of Windows service execution for lateral movement and payload launch. Another DragonForce intrusion used AnyDesk and log wiping to maintain access and hinder response, while a separate insider case involved a Python keylogger installed on a shared machine to capture credentials. The findings underscore the need for MFA, least privilege, removal of shared accounts, tighter control of remote-access tools, stronger backups, centralized logging, longer EDR retention, and faster patching.
Mar 9
Mitre Attack Website
