[Tech-l] FW: Message from the MS-ISAC: FBI FLASH - Increase in PYSA Ransomware Targeting Education Institutions - TLP:WHITE

[Thor Sage]

Good morning.
Please find the below and attached information regarding recent increases in ransomware attacks targeting K12 schools.  It is important that all of your users remain vigilant and that they scrutinize every email.
Thanks,
Thor


Thor Sage
Executive Director
Miami Valley Educational Computer Association
937-767-1468  x3101
[http://www.mveca.org/images/logo.gif]<http://www.mveca.org/>       [i] <https://www.linkedin.com/company/mveca/> [t] <https://twitter.com/mvecarcog> [f] <https://www.facebook.com/MVECA-707401659416692/>
Not-for-profit Technology Services for Education and Local Governments


From: MS-ISAC Advisory <MS-ISAC.Advisory at msisac.org>
Sent: Tuesday, March 16, 2021 9:41 AM
To: Michael Aliperti <Michael.Aliperti at cisecurity.org>
Subject: Message from the MS-ISAC: FBI FLASH - Increase in PYSA Ransomware Targeting Education Institutions - TLP:WHITE

TLP: WHITE
TO: All MS-ISAC Members and Partners

DATE: March 16, 2021

SUBJECT: FBI FLASH - Increase in PYSA Ransomware Targeting Education Institutions - TLP: WHITE

FBI reporting has indicated a recent increase in PYSA ransomware targeting education institutions in 12 US states and the United Kingdom. PYSA, also known as Mespinoza, is a malware capable of exfiltrating data and encrypting users’ critical files and data stored on their systems. The unidentified cyber actors have specifically targeted higher education, K-12 schools, and seminaries. These actors use PYSA to exfiltrate data from victims prior to encrypting victim’s systems to use as leverage in eliciting ransom payments.

The full FLASH has been attached to this email for your reference.

24x7 Security Operations Center
Multi-State Information Sharing and Analysis Center (MS-ISAC)
Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC)
31 Tech Valley Drive
East Greenbush, NY 12061
SOC at cisecurity.org<mailto:SOC at cisecurity.org> - 1-866-787-4722
[cid:image001.jpg at 01D40C67.01A3BDE0]
       [cid:image002.png at 01D63E63.4D52BA40]     [cid:image003.png at 01D63E63.4D52BA40]    [cid:image004.png at 01D63E63.4D52BA40]     [cid:image005.png at 01D63E63.4D52BA40]

TLP: WHITE
Disclosure is not limited. Subject to standard copyright rules, TLP: WHITE information may be distributed without restriction.
http://www.us-cert.gov/tlp/

This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.

. . . . .
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image007.jpg
Type: image/jpeg
Size: 4128 bytes
Desc: image007.jpg
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image008.png
Type: image/png
Size: 1892 bytes
Desc: image008.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image009.png
Type: image/png
Size: 2176 bytes
Desc: image009.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image010.png
Type: image/png
Size: 1889 bytes
Desc: image010.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image011.png
Type: image/png
Size: 2058 bytes
Desc: image011.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 3184 bytes
Desc: image001.jpg
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment-0001.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 1229 bytes
Desc: image002.jpg
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment-0002.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.jpg
Type: image/jpeg
Size: 1197 bytes
Desc: image003.jpg
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment-0003.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image004.jpg
Type: image/jpeg
Size: 1194 bytes
Desc: image004.jpg
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment-0004.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: CP-000142-MW.pdf
Type: application/pdf
Size: 974561 bytes
Desc: CP-000142-MW.pdf
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20210316/d97cb191/attachment.pdf>