pysa is a financially motivated ransomware group known for targeting critical infrastructure, healthcare, and education sectors.
pysa is a ransomware operated by a financially motivated cybercrime group. It primarily targets critical infrastructure, healthcare, and education sectors. Key TTPs include encrypting files using asymmetric encryption and appending the .pysa extension to affected files. Defenders should focus on securing backups, maintaining vigilance against phishing emails, and enforcing network segmentation.
Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the extension "pysa" is probably derived from the Zanzibari Coin with the same name.
The pysa ransomware primarily targets critical infrastructure, healthcare, and education sectors.
The pysa ransomware appends the .pysa file extension to encrypted files.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.