H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Pysa](https://attack.mitre.org/software/S0583) is a ransomware that was first used in October 2018 and has been seen to target particularly high-value finance, government and healthcare organizations.(Citation: CERT-FR PYSA April 2020)

Labels

malware

16 recorded

Relationships

uses

to Brute Force

Technique

uses

to Credentials In Files

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Disable or Modify Tools

Technique

uses

to File Deletion

Technique

uses

to Inhibit System Recovery

Technique

uses

to LSASS Memory

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Network Service Discovery

Technique

uses

to PowerShell

Technique

uses

to Python

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Service Execution

Technique

uses

to Service Stop

Technique

uses

to System Network Configuration Discovery

Technique

6 external

References

mitre-attack

S0583

open

Pysa

—

Mespinoza

—

CERT-FR PYSA April 2020

https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf

open

DFIR Pysa Nov 2020

https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/

open

NHS Digital Pysa Oct 2020

https://digital.nhs.uk/cyber-alerts/2020/cc-3633

open