Ransomware Group
Pysa
Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the extension "pysa" is probably derived from the Zanzibari Coin with the same name.
Known victims309
Threat level
HIGH
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
- ProcDump
- SessionGopher
DiscoveryEnum
- ADRecon
- Advanced IP Scanner
- Advanced Port Scanner
Exfiltration
- FileZilla
- WinSCP
LOLBAS
- PsExec
- WMIC
Offsec
- Chashell
- Koadic
- PowerShell Empire
- PowerSploit
Known infrastructure
The following Tor hidden services have been associated with this group:
Pysa's Partners
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Pysa’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request