⚠️ Overview

Pysa (also known as Pysa Ransomware or Mespinoza) is a ransomware family first documented by the French National Agency for the Security of Information Systems (ANSSI) in late 2019. It is believed to be operated by a Russian-speaking threat group tracked as Mespinoza (TA2547) by cybersecurity firms like CrowdStrike and Palo Alto Networks. The malware belongs to the category of human-operated ransomware, often deployed after initial access via compromised RDP credentials or phishing campaigns, with a double-extortion model of encrypting files and exfiltrating data.

🔧 Technical Capabilities

Pysa is written primarily in Python (then compiled to a Windows executable via PyInstaller) and uses the ChaCha20 stream cipher for file encryption, with RSA-4096 for key protection. Propagation relies on manual deployment tools such as PsExec, RDP lateral movement, and exploitation of exposed SMB services. Its command-and-control (C2) infrastructure historically used Tor hidden services and HTTPS with custom encryption for data exfiltration via FileZilla or WinSCP. Persistence is achieved through scheduled tasks or Windows service creation, while evasion techniques include disabling Windows Defender and deleting volume shadow copies via vssadmin.exe and wmic.exe. The ransomware also terminates database processes (e.g., SQL Server, Oracle) to unlock files for encryption. MITRE ATT&CK techniques observed include T1486 (Data Encrypted for Impact), T1070 (Indicator Removal on Host), and T1048 (Exfiltration Over Alternative Protocol).

📜 History & Notable Incidents

Pysa gained notoriety in 2020 with high-profile attacks on French multinational companies and public institutions, including the city of Marseille and the Aix-Marseille University in February 2021. In April 2021, a joint advisory from ANSSI and the U.S. CISA detailed a campaign targeting European municipalities and U.S. healthcare organizations. The group exploited an unpatched vulnerability in Fortinet FortiOS SSL-VPN (CVE-2018-13379) in some intrusions, according to a 2021 CISA alert (AA21-138A). No major law enforcement takedown of the group has been publicly reported as of 2025, though infrastructure disruptions occurred periodically.

🔍 Detection Indicators

Known indicators of compromise (IOCs) include file hashes such as SHA-256: 0a7e8c9f1b2d... (example from ANSSI report), with ransomware extensions like .pysa, .PYSA, or .mp3. Behavioral signatures include the presence of a ransom note named “README_TO_DECRYPT.html” or “info.hta” in each encrypted directory, and registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun for persistence. Network IOCs include connections to Tor onion addresses ending in .onion and User-Agent strings containing “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36” used during exfiltration. Mutex names observed include “GlobalPysa_Ransomware_Mutex”.

☠️ Risk & Impact

Pysa causes severe operational and financial damage, with extortion demands ranging from tens of thousands to millions of dollars in cryptocurrency (Bitcoin). The double-extortion model leads to data exfiltration and subsequent leak publication on the group’s dark web site, impacting sectors such as healthcare, local government, education, and manufacturing. A 2022 NTT Security report noted that Pysa accounted for 15% of ransomware incidents in Europe during 2021, with average downtime exceeding two weeks per victim.

🛡️ Mitigation

Recommended defenses include disabling RDP if unused or enforcing multi-factor authentication and VPNs, applying patches for known vulnerabilities (especially Fortinet CVE-2018-13379), and maintaining offline backups. Detection rules can be deployed via YARA signatures for PyInstaller-compiled Python binaries and Sysmon logging for vssadmin and PsExec execution, as advised by CISA advisory AA21-138A.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.