FBI Warns that PYSA Ransomware is Targeting Schools



FBI Warns of PYSA RansomwareThe FBI has warned of a wave of ransomware attacks against schools and other entities across the United States and the UK.

“FBI reporting has indicated a recent increase in PYSA ransomware targeting education institutions in 12 US states and the United Kingdom,” the Bureau says. “PYSA, also known as Mespinoza, is a malware capable of exfiltrating data and encrypting users’ critical files and data stored on their systems. The unidentified cyber actors have specifically targeted higher education, K-12 schools, and seminaries. These actors use PYSA to exfiltrate data from victims prior to encrypting victim’s systems to use as leverage in eliciting ransom payments. “

As in most ransomware incidents, the criminals in this case usually gain access via exposed RDP ports or through phishing emails.

“The FBI has become aware of PYSA ransomware attacks against US and foreign government entities, educational institutions, private companies, and the healthcare sector by unidentified cyber actors,” the advisory says. “PYSA typically gains unauthorized access to victim networks by compromising Remote Desktop Protocol (RDP) credentials and/or through phishing emails. The cyber actors use Advanced Port Scanner and Advanced IP Scanner1 to conduct network reconnaissance, and proceed to install open source tools, such as PowerShell Empire2, Koadic3, andMimikatz4. The cyber actors execute commands to deactivate antivirus capabilities on the victim network prior to deploying the ransomware.“

The PYSA actors are also among the ransomware groups that steal data and threaten to publish it if the victim refuses to pay up.

“The cyber actors then exfiltrate files from the victim’s network, sometimes using the free open source tool WinSCP5, and proceed to encrypt all connected Windows and/or Linux devices and data, rendering critical files, databases, virtual machines, backups, and applications inaccessible to users,” the Bureau says. “In previous incidents, cyber actors exfiltrated employment records that contained personally identifiable information (PII), payroll tax information, and other data that could be used to extort victims to pay a ransom.”

New-school security awareness training can help prevent ransomware attackers from gaining a foothold by teaching your employees how to recognize phishing emails.

The FBI has the story.


Free Ransomware Simulator Tool

Bad guys are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 20 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RanSimScreen-1Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 21 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/ransomware-simulator

Topics: Ransomware

Subscribe To Our Blog


Ransomware Hostage Rescue Manual




Get the latest about social engineering

Subscribe to CyberheistNews