Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

PYSA · Threat actor profile

// THREAT ACTOR

PYSA_

Dormant

PYSA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of PYSA — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

308 Victims tracked
0 / 1 Active mirrors
2021-09-09 First listing
2021-12-29 Most recent

Victims by year

  • 2021 308

Leak site mirrors

1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion Pysa's Partners snapshot · 2022-02-21 21:07

Recent victims

The 50 most recent victims claimed by PYSA. Total in the index: 308.

Date listed Victim Description
2021-12-29
2021-12-06 CHR Solutions
2021-11-08 The Skinners Kent Academy
2021-11-08 Kent County Council
2021-11-08 Rusty Hardin & Associates
2021-11-08 R.E. Pedrotti Co.
2021-11-08 UEMOA
2021-11-08 Skatetown
2021-11-08 CHRYSO
2021-11-08 itimCloud
2021-11-08 Bayonet
2021-11-08 Fly Arik Air
2021-11-08 Las Vegas Cancer Center
2021-11-08 CarpenterProjects
2021-11-08 Westmont Helena
2021-11-08 Woodchurch High School
2021-11-08 Emkay Food Sales
2021-11-08 Premier Energy
2021-11-08 Schmincke Künstlerfarben
2021-11-08 Stratford Land
2021-11-08 Dr Schneider
2021-11-08 Rockbridge and Bath County
2021-11-08 Nordic Pharma
2021-11-08 The Leschaco Group
2021-11-08 Eason Horticultural Resources
2021-11-08 ΤΕΧΝΟΛΟΓΙΚΟ ΠΑΝΕΠΙΣΤΗΜΙΟ ΚΥΠΡΟΥ
2021-11-08 SWL
2021-11-08 Lucton School
2021-11-08 Hickory Veterinary Hospital
2021-11-08 Westvale Primary School
2021-11-08 Property Damage Restoration
2021-11-08 Garner Dental Group
2021-11-08 MVS Mailers
2021-11-08 EHS
2021-11-08 Comstock Johnson Architects
2021-11-08 La Bodega
2021-11-08 Gulfport MS
2021-11-08 Pitts Baptist Church
2021-11-08 Emi Jay
2021-11-08 Niemi Bil i Luleå
2021-11-08 Department of Justice and Constitutional Development
2021-11-08 MPRL E&P
2021-11-08 Capitol Beauty School
2021-11-08 Bryant Industrial Services
2021-11-08 Alternatives, Inc.
2021-11-08 Family Dental Health
2021-11-08 Community Brands
2021-11-08 Vision Source
2021-11-08 AECOM
2021-11-08 Jalasoft

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.