{"id":43907,"date":"2021-11-12T19:18:00","date_gmt":"2021-11-12T19:18:00","guid":{"rendered":"http:\/\/a5b8e694-ae09-4991-aa2f-ad1b9387c6e0"},"modified":"2021-11-12T19:18:00","modified_gmt":"2021-11-12T19:18:00","slug":"ransomware-experts-question-massive-pysa-mespinoza-victim-dump","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-experts-question-massive-pysa-mespinoza-victim-dump\/","title":{"rendered":"Ransomware experts question massive Pysa\/Mespinoza victim dump"},"content":{"rendered":"

The Pysa ransomware group dumped dozens of victims onto their leak site this week right after US law enforcement officials announced a range of actions taken against ransomware groups. <\/p>\n

More than 50 companies, universities, and organizations had their names added to the ransomware group’s leak site. <\/p>\n

The group, which also goes by the name Mespinoza, was called out by the FBI in March<\/a> for specifically targeting “higher education, K-12 schools, and seminaries.” The FBI said at least 12 educational institutions across the US and UK had been hit with the ransomware. The French National Agency for the Security of Information Systems issued a similar alert<\/a> one year earlier.<\/p>\n

Multiple ransomware experts questioned the timing of the leak, noting that Pysa has a penchant for waiting to add victims to their leak site. <\/p>\n

Recorded Future ransomware expert Allan Liska told ZDNet he did not think all of the victims published to the site were new.<\/p>\n

“We have seen them take six months, and even longer, from when a victim is first hit to when [stolen data] is published,” Liska said. “This could be all the victims they have been stalling on publishing data, but it would represent more victims than we have seen from them the rest of the year. It is a lot of different organizations, from around the world, with no theme.” <\/p>\n

Emsisoft threat analyst Brett Callow told ZDNet that Pysa names and shames its victims weeks, or sometimes months, after the attacks take place, differentiating it from other ransomware groups. <\/p>\n

<\/section>\n

The reason they waited this long to leak victim information is still unclear, he said, adding that it was curious they dumped this many names all at once. <\/p>\n

\"fdsi14mvuaquhzl.png\"<\/span>