Skip to main content
Darkfield

Operator dossier

Pysa (also tracked as Mespinoza, Pyza) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 309 public victims claimed by this operator between July 1, 2020 and September 20, 2022. The Pysa (Protect Your System Amigo) ransomware group emerged in July 2020 as a financially motivated cybercriminal organization that has impacted over 300 victims globally through systematic targeting of critical infrastructure sectors. The group is believed to operate independently rather than as a Ransomware-as-a-Service model, with suspected origins traced to Eastern European cybercriminal networks, though definitive attribution remains unconfirmed by law enforcement agencies. Pysa operators typically gain initial access through exploitation of Remote Desktop Protocol vulnerabilities, phishing campaigns, and exploitation of unpatched systems, employing tools such as PowerShell Empire, Cobalt Strike, and custom backdoors before deploying their ransomware payload that utilizes RSA and AES encryption algorithms. The group engages in double extortion tactics, systematically exfiltrating sensitive data before encryption and threatening public release through their "Partner Sites" leak platform if ransom demands are not met. Notable campaigns include attacks against major educational institutions, healthcare systems, and government entities primarily in the United States, United Kingdom, Italy, and Canada, with particular focus on the education and healthcare sectors during the COVID-19 pandemic, drawing significant attention from CISA and FBI advisories warning of their targeting of critical infrastructure. Law enforcement agencies including the FBI have issued multiple alerts regarding Pysa's activities, though the group has demonstrated resilience and continued operations despite increased scrutiny, with recent activity suggesting they remain active as of 2024.

Most-targeted sectors

Most-affected countries

Recent disclosures by Pysa

Most recent 150 of 309 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Pysa →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Pysa

aka Mespinoza, Pyza · 309 victims indexed · first seen 6 years ago · last activity 4 years ago

309
Victims indexed
#29 of 364 tracked operators
2y 2m
Active period
Jul 2020 → Sep 2022
5
Countries hit
top United States · 16

At a glance

Status
inactive
Aliases
Mespinoza, Pyza
First seen
6 years ago
Last activity
4 years ago
Onion sites
2 known endpoints
Primary sector
Education · 35 hits

About

The Pysa (Protect Your System Amigo) ransomware group emerged in July 2020 as a financially motivated cybercriminal organization that has impacted over 300 victims globally through systematic targeting of critical infrastructure sectors. The group is believed to operate independently rather than as a Ransomware-as-a-Service model, with suspected origins traced to Eastern European cybercriminal networks, though definitive attribution remains unconfirmed by law enforcement agencies. Pysa operators typically gain initial access through exploitation of Remote Desktop Protocol vulnerabilities, phishing campaigns, and exploitation of unpatched systems, employing tools such as PowerShell Empire, Cobalt Strike, and custom backdoors before deploying their ransomware payload that utilizes RSA and AES encryption algorithms. The group engages in double extortion tactics, systematically exfiltrating sensitive data before encryption and threatening public release through their "Partner Sites" leak platform if ransom demands are not met. Notable campaigns include attacks against major educational institutions, healthcare systems, and government entities primarily in the United States, United Kingdom, Italy, and Canada, with particular focus on the education and healthcare sectors during the COVID-19 pandemic, drawing significant attention from CISA and FBI advisories warning of their targeting of critical infrastructure. Law enforcement agencies including the FBI have issued multiple alerts regarding Pysa's activities, though the group has demonstrated resilience and continued operations despite increased scrutiny, with recent activity suggesting they remain active as of 2024.

References

36 links

External sources curated by the MISP threat-intel community.

Timeline

8 months
2020-07-01T00:00:00+00:00 · 12020-09-01T00:00:00+00:00 · 12020-10-01T00:00:00+00:00 · 12021-09-01T00:00:00+00:00 · 2182021-10-01T00:00:00+00:00 · 272021-11-01T00:00:00+00:00 · 592021-12-01T00:00:00+00:00 · 12022-09-01T00:00:00+00:00 · 1
2020-07-01T00:00:00+00:002022-09-01T00:00:00+00:00

Top countries

🇺🇸 United States
16
🇬🇧 United Kingdom
3
🇮🇹 Italy
1
🇨🇦 Canada
1
🇫🇷 France
1
United States dossier →United Kingdom dossier →Italy dossier →Canada dossier →

Top sectors

Education
35
Healthcare
10
Manufacturing
6
Government
5
Food & Agriculture
4
Construction
4
Media
4
Technology
4
Education dossier →Healthcare dossier →Manufacturing dossier →Government dossier →

MITRE ATT&CK

17 techniques · 10 tactics

Tactics

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessLateral MovementCollectionExfiltrationImpact

Techniques

Recent victims

Loading…

Onion infrastructure

2 known
  • http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion
  • http://pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion/partners.html

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Pysa posts a victim.

Add Pysa to your watchlist — Pro pings you within 5 minutes of any new Pysa leak-site post, Telegram callout, or affiliate-rebrand inference.