Pysa

ATP Sandbox Adv. HeuristicsAV

Description

Pysa is a ransomware family first used in October 2018 that has particularly targeted high value finance, government, and healthcare organizations.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

Mespinoza

MITRE ATT&CK techniques

16 techniques across 7 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.006Python
- T1059.001PowerShell
T1569System Services
- T1569.002Service Execution

TA0005 Stealth

T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1070Indicator Removal
- T1070.004File Deletion

TA0006 Credential Access

T1003OS Credential Dumping
- T1003.001LSASS Memory
T1110Brute Force
T1552Unsecured Credentials
- T1552.001Credentials In Files

TA0007 Discovery

T1016System Network Configuration Discovery
T1046Network Service Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.001Remote Desktop Protocol

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery

TA0112 Defense Impairment

T1112Modify Registry
T1685Disable or Modify Tools

Alert name variants

Alert Name	Engine
Generic.Ransom.Mespinoza.1363040B	AV
Generic.Ransom.Mespinoza.28369202	AV
Generic.Ransom.Mespinoza.39CB4E51	AV
Generic.Ransom.Mespinoza.3E56E7CC	AV
Generic.Ransom.Mespinoza.3EC38EDA	AV
Generic.Ransom.Mespinoza.AF3A69C9	AV
Generic.Ransom.Mespinoza.C05CC4B4	AV
Generic.Ransom.Mespinoza.D1CEECFF	AV
Generic.Ransom.Mespinoza.D71AEC53	AV
Generic.Ransom.Mespinoza.DAE72674	AV
Generic.Ransom.Mespinoza.EA4D84A6	AV
Generic.Ransom.Mespinoza.F0144297	AV
Generic.Ransom.Mespinoza.F2C14C58	AV
Script-Python.Ransomware.Pysa	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Mespinoza	ATP Sandbox Adv. Heuristics
Win64.Trojan.Mespinoza	ATP Sandbox Adv. Heuristics

Related families

Qilin Cobalt Strike REvil HermeticWiper InvisiMole

References