Pysa
- ID
- S0583
- Type
- Malware
- Associated names
- Mespinoza
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
Pysa is a ransomware that was first used in October 2018 and has been seen to target particularly high-value finance, government and healthcare organizations.[1]
Techniques used (16)
- T1003.001 LSASS Memory
- T1016 System Network Configuration Discovery
- T1021.001 Remote Desktop Protocol
- T1036.005 Match Legitimate Resource Name or Location
- T1046 Network Service Discovery
- T1059.001 PowerShell
- T1059.006 Python
- T1070.004 File Deletion
- T1110 Brute Force
- T1112 Modify Registry
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1552.001 Credentials In Files
- T1569.002 Service Execution
- T1685 Disable or Modify Tools