PYSA is a human-operated ransomware group that emerged in October 2019, also known by the name Mespinoza, from which its ransomware variant is derived. The name PYSA is an acronym for "Protect Your System Amigo", a phrase often found within their ransom notes. Operating primarily for financial gain, PYSA engages in double extortion tactics, first exfiltrating sensitive data from victim networks before encrypting files and demanding a ransom. What sets PYSA apart is its highly manual approach to operations, meticulously researching and compromising high-value targets rather than relying on automated widespread campaigns. While generally functioning as a Ransomware-as-a-Service (RaaS) model, PYSA's communication with victims often deviates from typical RaaS setups, preferring direct email correspondence over ticketing systems.

Aliases del actor

MespinozaPyzaPysa