pysa Ransomware
Tracked since Jul 1, 2020
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the extension "pysa" is probably derived from the Zanzibari Coin with the same name.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Observed tools
Credential Theft
Mimikatz · ProcDump · SessionGopher
Discovery Enum
ADRecon · Advanced IP Scanner · Advanced Port Scanner
Exfiltration
FileZilla · WinSCP
LOLBAS
PsExec · WMIC
Offsec
Chashell · Koadic · PowerShell Empire · PowerSploit
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live