LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0583: Pysa

Pysa is a ransomware that was first used in October 2018 and has been seen to target particularly high-value finance, government and healthcare organizations.[1]

EnterpriseS0583MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Pysa is a Windows ransomware entry in ATT&CK associated with high-value finance, government, and healthcare targeting. Its practical significance is not just encryption: the related behaviors show a ransomware intrusion path that can involve credential access, discovery, lateral movement over RDP, service-based execution, defense impairment, recovery inhibition, and final data encryption. Leaders should treat this as a test case for whether identity controls, endpoint visibility, backup resilience, and incident response decisions hold up before business operations are interrupted.

Executive priority

Prioritize Pysa as an operational resilience and ransomware-readiness scenario. The ATT&CK relationships point to controls that often decide business impact: protection of Windows credentials such as LSASS material, restriction and monitoring of RDP, detection of PowerShell and service execution, protection of security tooling, and recovery controls that cannot be easily disabled. For regulated or high-availability environments, this behavior is also useful for audit evidence: prove that logging, privileged access controls, backup recovery, and incident escalation are tested against ransomware techniques rather than documented only as policy.

Technical view

Validate coverage on Windows endpoints for the related techniques: LSASS memory access, brute force activity, credentials stored in files, PowerShell and Python execution, RDP lateral movement, service execution, registry modification, file deletion, security tool tampering, service stopping, recovery inhibition, and data encryption for impact. Because the object has no official ATT&CK detection text, SOC teams should map detections to the related techniques and confirm telemetry exists before assuming coverage. IR teams should prepare triage paths that connect credential theft, RDP movement, defense impairment, backup interference, and encryption activity into one incident timeline.

Likely telemetry

  • Windows endpoint process creation and command-line logging
  • PowerShell execution logs and script block/module logging where available
  • Authentication logs for failed and successful logons, especially RDP-related activity
  • Windows service creation, modification, stop, and execution events
  • Registry modification telemetry

Detection direction

  • Build detection around the ATT&CK relationships rather than the malware name alone, since no official detection guidance is supplied.
  • Correlate credential-access signals with subsequent RDP logons, service execution, and discovery to reduce single-event false positives.
  • Tune PowerShell, Python, registry, and service-control detections for administrative baselines; many commands can be legitimate but become higher priority when chained with ransomware-impact behaviors.
  • Validate alerting for security tool disablement or modification, because defense impairment can create a visibility gap before encryption.
  • Confirm that recovery-inhibition and service-stop events are monitored as high-severity precursors to business disruption, not only as post-encryption artifacts.

Mitigation priorities

  • Harden privileged access and credential exposure first, including controls that reduce access to LSASS material and insecure credentials in files.
  • Restrict, monitor, and justify RDP usage; require strong authentication and limit lateral movement paths where operationally feasible.
  • Constrain scripting and service execution through least privilege, application control, and administrative workflow review.
  • Protect endpoint, logging, and security tools from tampering and monitor their health continuously.
  • Test backup and recovery processes against attempts to inhibit recovery, including restoration from protected or offline backups.
Additional notes and limits

The supplied object identifies Pysa as Windows ransomware first used in October 2018 and seen targeting high-value finance, government, and healthcare organizations. The most useful defensive value comes from the related ATT&CK techniques, which outline a ransomware-relevant chain from credential access and discovery through lateral movement, execution, defense impairment, recovery inhibition, and encryption.

ATT&CK provides no official detection text for this object, and the malware object itself lists Windows as the platform with no tactics specified. Some related techniques have broader platform metadata, but that should not be interpreted as Pysa platform coverage beyond the supplied malware platform. Local telemetry, architecture, and business process evidence are required to determine actual exposure or detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Pysa

Pysa is a ransomware that was first used in October 2018 and has been seen to target particularly high-value finance, government and healthcare organizations.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

16 rows
DomainIDNameRelationship / procedure
EnterpriseT1016System Network Configuration Discovery

Pysa can perform network reconnaissance using the Advanced IP Scanner tool.[1]

EnterpriseT1059.006PythonSub-technique

Pysa has used Python scripts to deploy ransomware.[1]

EnterpriseT1552.001Credentials In FilesSub-technique

Pysa has extracted credentials from the password database before encrypting the files.[1]

EnterpriseT1685Disable or Modify Tools

Pysa has the capability to stop antivirus services and disable Windows Defender.[1]

EnterpriseT1059.001PowerShellSub-technique

Pysa has used Powershell scripts to deploy its ransomware.[1]

EnterpriseT1486Data Encrypted for Impact

Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.[1]

EnterpriseT1112Modify Registry

Pysa has modified the registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” and added the ransom note.[1]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

Pysa has laterally moved using RDP connections.[1]

EnterpriseT1569.002Service ExecutionSub-technique

Pysa has used PsExec to copy and execute the ransomware.[1]

EnterpriseT1003.001LSASS MemorySub-technique

Pysa can perform OS credential dumping using Mimikatz.[1]

EnterpriseT1489Service Stop

Pysa can stop services and processes.[1]

EnterpriseT1490Inhibit System Recovery

Pysa has the functionality to delete shadow copies.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Pysa has executed a malicious executable by naming it svchost.exe.[1]

EnterpriseT1110Brute Force

Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.[1]

EnterpriseT1070.004File DeletionSub-technique

Pysa has deleted batch files after execution. [1]

EnterpriseT1046Network Service Discovery

Pysa can perform network reconnaissance using the Advanced Port Scanner tool.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1059.006: PythonEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · TechniqueT1489: Service StopEnterpriseuses · TechniqueT1490: Inhibit System RecoveryEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1110: Brute ForceEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
1d1d5fc995263a57...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle1d1d5fc99526…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  2. [2]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  3. [3]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  4. [4]
    DFIR Pysa Nov 2020

    THe DFIR Report. (2020, November 23). PYSA/Mespinoza Ransomware. Retrieved March 17, 2021.

    Open source URL
  5. [5]
    DFIR Pysa Nov 2020

    THe DFIR Report. (2020, November 23). PYSA/Mespinoza Ransomware. Retrieved March 17, 2021.

    Open source URL
  6. [6]
    DFIR Pysa Nov 2020

    THe DFIR Report. (2020, November 23). PYSA/Mespinoza Ransomware. Retrieved March 17, 2021.

    Open source URL
  7. [7]
    Mespinoza

    (Citation: CERT-FR PYSA April 2020)(Citation: DFIR Pysa Nov 2020)(Citation: NHS Digital Pysa Oct 2020)

  8. [8]
    Mespinoza

    (Citation: CERT-FR PYSA April 2020)(Citation: DFIR Pysa Nov 2020)(Citation: NHS Digital Pysa Oct 2020)

  9. [9]
    Mespinoza

    (Citation: CERT-FR PYSA April 2020)(Citation: DFIR Pysa Nov 2020)(Citation: NHS Digital Pysa Oct 2020)

  10. [10]
    NHS Digital Pysa Oct 2020

    NHS Digital. (2020, October 10). Pysa Ransomware: Another 'big-game hunter' ransomware. Retrieved March 17, 2021.

    Open source URL
  11. [11]
    NHS Digital Pysa Oct 2020

    NHS Digital. (2020, October 10). Pysa Ransomware: Another 'big-game hunter' ransomware. Retrieved March 17, 2021.

    Open source URL
  12. [12]
    NHS Digital Pysa Oct 2020

    NHS Digital. (2020, October 10). Pysa Ransomware: Another 'big-game hunter' ransomware. Retrieved March 17, 2021.

    Open source URL
  13. [13]
    Pysa

    (Citation: CERT-FR PYSA April 2020)(Citation: DFIR Pysa Nov 2020)(Citation: NHS Digital Pysa Oct 2020)

  14. [14]
    Pysa

    (Citation: CERT-FR PYSA April 2020)(Citation: DFIR Pysa Nov 2020)(Citation: NHS Digital Pysa Oct 2020)

  15. [15]
    Pysa

    (Citation: CERT-FR PYSA April 2020)(Citation: DFIR Pysa Nov 2020)(Citation: NHS Digital Pysa Oct 2020)

  16. [16]
    mitre-attackS0583
    Open source URL
  17. [17]
    mitre-attackS0583
    Open source URL
  18. [18]
    mitre-attackS0583
    Open source URL
  19. [19]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  20. [20]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  21. [21]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  22. [22]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  23. [23]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  24. [24]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  25. [25]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  26. [26]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  27. [27]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  28. [28]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  29. [29]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  30. [30]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  31. [31]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  32. [32]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  33. [33]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  34. [34]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  35. [35]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  36. [36]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  37. [37]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  38. [38]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  39. [39]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  40. [40]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  41. [41]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  42. [42]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  43. [43]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  44. [44]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  45. [45]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  46. [46]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
  47. [47]
    CERT-FR PYSA April 2020

    CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use