Pysa Ransomware

Pysa is a new ransomware tool operated by an unknown APT group. Much like the more well-known Ryuk, Sobinokibi, and Maze ransomware, it also targets large or particularly high-value finance, government and healthcare organisations.

Threat ID:: CC-3633
Category:: Ransomware
Threat Severity:: Information only
Threat Vector:: Insecure network, Email spam
Published:: 14 October 2020 12:00 AM

Report a cyber attack: call 0300 303 5222 or email carecert@nhsdigital.nhs.uk

Summary

Affected platforms

The following platforms are known to be affected:

Versions: all supported

Microsoft Windows

Threat details

Introduction

First observed on October 2019, Pysa (also known as Mespinoza) is a human-operated ransom tool created by an as yet unidentified advanced persistent threat group.

As with other popular ransomware in 2020 such as Ryuk and Maze; Pysa focuses on high value financial and governmental targets, but has also been involved in attacks on healthcare, education, and law enforcement organisations.

Delivery

PYSA ransomware is delivered via brute-force attacks on exposed Active Directory services or other management interfaces, spam or phishing email campaigns, and unauthorized Remote Desktop Protocol (RDP) connections to domain controllers. The attackers methodically scan network files and use PsExec to move laterally.

Activities

Once delivered, Pysa will attempt to extract sensitive information (credentials, databases, or internal business files) before encrypting all accessible non-system file using an AES implementations, the keys for which are then encrypted with RSA.

Data stolen by Pysa will then be used by its operators to extort affected organisations into meeting their ransom demands. Organisations that do not comply will have their date posted on a leak site controlled by Pysa's operators.

Threat updates

Date	Update
1 Apr 2021	Delivery and host indicators updated Information on the delivery mechanism has been updated and additional file hashes added.

Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

Critical data is frequently saved in multiple backup locations.
At least one backup is kept offline at any time (separated from live systems).
Backups and incident recovery plans are tested to ensure that data can be restored when needed.
User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
Infected systems are disconnected from the network and powered down as soon as practicable.
Any user account credentials that may have been compromised should be reset on a clean device
Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

Secure configurations are applied to all devices.
Security updates are applied at the earliest opportunity.
Tamper protection settings in security products are enabled where available.
Obsolete platforms are segregated from the rest of the network.
IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
Administrative accounts are only used for necessary purposes.
Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Host indicators

SHA256 hashes