S0583 Pysa

malwareEnterprise

platformsWindows

also known asPysa · Mespinoza

Pysa is a ransomware that was first used in October 2018 and has been seen to target particularly high-value finance, government and healthcare organizations.

techniques used (16)

ATT&CK techniques this enables or maps to.

T1003.001LSASS Memory
T1016System Network Configuration Discovery
T1021.001Remote Desktop Protocol
T1036.005Match Legitimate Resource Name or Location
T1046Network Service Discovery
T1059.001PowerShell
T1059.006Python
T1070.004File Deletion
T1110Brute Force
T1112Modify Registry
T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1552.001Credentials In Files
T1569.002Service Execution
T1685Disable or Modify Tools

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan