Pysa
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 19 incidents
- Sources
- 11 sources
- First seen
- 2020-03-01
- Last seen
- 2021-09-04
- Updated
- 2026-10-03 02:02
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Mespinoza, also known as Pysa, is a ransomware threat actor group linked to Russia. The group primarily targets healthcare and education organizations in the United States and has also attacked entities abroad, such as a municipality in South Africa. Its operations are financially motivated, employing double‑extortion tactics: it exfiltrates sensitive data before encrypting files with the Mespinoza ransomware and then threatens to publish the stolen information on a dark‑web leak site unless a ransom is paid. Observed TTPs include the use of Mespinoza ransomware payloads, data theft prior to encryption, and maintaining a leak site to pressure victims. Notable publicly reported incidents include the September 2021 attack on a Las Vegas cancer center affecting roughly 3,000 patients, the May 2021 ransomware strike on Consolidated High School District 230 that disrupted internet and phone services, the April 2021 breach of One Community Health that exposed patient Social Security numbers and medical records, and the November 2020 ransomware incident against the Nama Khoi Municipality in South Africa where data were leaked without a preceding ransom demand.
Incidents
Attributed incidents are available to members.
19 incidentsSources
Sources available to members: 11 sources.