MITRE ATT&CKsoftware (malware)

S0583 Pysa

Published 2021-03-01 Modified 2025-04-25 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Mespinoza
Version
1.0
Created
2021-03-01

Description

Pysa is a ransomware that was first used in October 2018 and has been seen to target particularly high-value finance, government and healthcare organizations.

Related

Uses · MITRE ATT&CK (16)

  • T1685 Disable or Modify Tools technique
  • T1569.002 Service Execution sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.006 Python sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1552.001 Credentials In Files sub-technique
  • T1070.004 File Deletion sub-technique
  • T1490 Inhibit System Recovery technique
  • T1489 Service Stop technique
  • T1486 Data Encrypted for Impact technique
  • T1016 System Network Configuration Discovery technique
  • T1046 Network Service Discovery technique
  • T1110 Brute Force technique
  • T1112 Modify Registry technique

References