R
Ransomwhere.org
Live MapLatest VictimsGroups
PaymentsTTPsIdentifyNewsDataAPI
LIVE
Ransomwhere.org

Real-time ransomware intelligence platform. Tracking threat actors, victims, and payments to raise awareness and help defend against ransomware attacks worldwide.

Platform

  • Live Map
  • Latest Victims
  • Groups
  • Payments
  • Identify
  • News

Resources

  • Data & Methodology
  • API Docs
  • NoMoreRansom
  • Ransomware.live
  • CISA Advisories

Data sourced from Ransomware.live API. For informational purposes only.

© 2026 Ransomwhere.org

Groups/pysa

pysa

Inactive

Mespinosa is a ransomware which encrypts file using an asymmetric encryption and adds .pysa as file extension. According to dissectingmalware the extension "pysa" is probably derived from the Zanzibari Coin with the same name.

311
Victims
1
Sites

Known Leak Sites

pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onionDLS

Victims (311)

Live
ΤΕΧΝΟΛΟΓΙΚΟ ΠΑΝΕΠΙΣΤΗΜΙΟ ΚΥΠΡΟΥ
pysa
CHR Solutions
pysa
The Skinners Kent Academy
pysa
Kent County Council
pysa
Rusty Hardin & Associates
pysa
R.E. Pedrotti Co.
pysa
UEMOA
pysa
Skatetown
pysa
CHRYSO
pysa
itimCloud
pysa
Bayonet
pysa
Fly Arik Air
pysa
Las Vegas Cancer Center
pysa
CarpenterProjects
pysa
Westmont Helena
pysa
Woodchurch High School
pysa
Emkay Food Sales
pysa
Premier Energy
pysa
Schmincke Künstlerfarben
pysa
Stratford Land
pysa
Dr Schneider
pysa
Rockbridge and Bath County
pysa
Nordic Pharma
pysa
The Leschaco Group
pysa
Eason Horticultural Resources
pysa

Top Targeted Countries

Unknown308
United Kingdom1
United States1
Canada1

Profile

:
:
:

Activity

Total victims311
Countries affected4
Last seen