<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Arial",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Good morning.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Please find the below and attached information regarding recent increases in ransomware attacks targeting K12 schools. It is important that all of your users remain vigilant and that they scrutinize every email.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thor<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#1F497D">Thor Sage<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Executive Director<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Miami Valley Educational Computer Association<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">937-767-1468 x3101<o:p></o:p></span></p>
<p class="MsoNormal"><a href="http://www.mveca.org/"><span style="color:#1F497D;text-decoration:none"><img border="0" width="174" height="64" style="width:1.8125in;height:.6666in" id="Picture_x0020_1" src="cid:image001.jpg@01D71A54.87E8E080" alt="http://www.mveca.org/images/logo.gif"></span></a><span style="color:#1F497D">
</span><a href="https://www.linkedin.com/company/mveca/"><span style="color:#1F497D;text-decoration:none"><img border="0" width="32" height="32" style="width:.3333in;height:.3333in" id="Picture_x0020_8" src="cid:image002.jpg@01D71A54.87E8E080" alt="i"></span></a><a href="https://twitter.com/mvecarcog"><span style="color:#1F497D;text-decoration:none"><img border="0" width="32" height="32" style="width:.3333in;height:.3333in" id="Picture_x0020_7" src="cid:image003.jpg@01D71A54.87E8E080" alt="t"></span></a><a href="https://www.facebook.com/MVECA-707401659416692/"><span style="color:#1F497D;text-decoration:none"><img border="0" width="32" height="32" style="width:.3333in;height:.3333in" id="Picture_x0020_6" src="cid:image004.jpg@01D71A54.87E8E080" alt="f"></span></a><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="color:#1F497D">Not-for-profit Technology Services for Education and Local Governments<o:p></o:p></span></i></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> MS-ISAC Advisory <MS-ISAC.Advisory@msisac.org> <br>
<b>Sent:</b> Tuesday, March 16, 2021 9:41 AM<br>
<b>To:</b> Michael Aliperti <Michael.Aliperti@cisecurity.org><br>
<b>Subject:</b> Message from the MS-ISAC: FBI FLASH - Increase in PYSA Ransomware Targeting Education Institutions - TLP:WHITE<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" align="center" style="text-align:center"><b><span style="font-family:"Arial",sans-serif">TLP: WHITE</span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif">TO: All MS-ISAC Members and Partners</span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif"> </span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif">DATE: March 16, 2021</span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif"> </span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif">SUBJECT: FBI FLASH - Increase in PYSA Ransomware Targeting Education Institutions - TLP: WHITE</span></b><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">FBI reporting has indicated a recent increase in PYSA ransomware targeting education institutions in 12 US states and the United Kingdom. PYSA, also known as Mespinoza, is a malware capable of
exfiltrating data and encrypting users’ critical files and data stored on their systems. The unidentified cyber actors have specifically targeted higher education, K-12 schools, and seminaries. These actors use PYSA to exfiltrate data from victims prior to
encrypting victim’s systems to use as leverage in eliciting ransom payments.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">The full FLASH has been attached to this email for your reference.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">24x7 Security Operations Center<br>
Multi-State Information Sharing and Analysis Center (MS-ISAC)</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC)<br>
31 Tech Valley Drive<br>
East Greenbush, NY 12061<br>
</span><a href="mailto:SOC@cisecurity.org"><span style="font-family:"Arial",sans-serif">SOC@cisecurity.org</span></a><span style="font-family:"Arial",sans-serif"> - 1-866-787-4722</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><img border="0" width="278" height="47" style="width:2.8958in;height:.4895in" id="Picture_x0020_11" src="cid:image007.jpg@01D71A47.26A7A480" alt="cid:image001.jpg@01D40C67.01A3BDE0"></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"> <img border="0" width="32" height="33" style="width:.3333in;height:.3437in" id="Picture_x0020_2" src="cid:image008.png@01D71A47.26A7A480" alt="cid:image002.png@01D63E63.4D52BA40"> <img border="0" width="32" height="33" style="width:.3333in;height:.3437in" id="Picture_x0020_3" src="cid:image009.png@01D71A47.26A7A480" alt="cid:image003.png@01D63E63.4D52BA40"> <img border="0" width="32" height="33" style="width:.3333in;height:.3437in" id="Picture_x0020_4" src="cid:image010.png@01D71A47.26A7A480" alt="cid:image004.png@01D63E63.4D52BA40"> <img border="0" width="32" height="33" style="width:.3333in;height:.3437in" id="Picture_x0020_5" src="cid:image011.png@01D71A47.26A7A480" alt="cid:image005.png@01D63E63.4D52BA40"></span><o:p></o:p></p>
<p class="MsoNormal" align="center" style="text-align:center;text-autospace:none">
<b><span style="font-family:"Arial",sans-serif"> </span></b><o:p></o:p></p>
<p class="MsoNormal" align="center" style="text-align:center"><b><span style="font-family:"Arial",sans-serif">TLP: WHITE</span></b><o:p></o:p></p>
<p class="MsoNormal" align="center" style="text-align:center"><b><span style="font-family:"Arial",sans-serif">Disclosure is not limited. Subject to standard copyright rules, TLP: WHITE information may be distributed without restriction.<br>
</span></b><a href="http://www.us-cert.gov/tlp/"><b><span style="font-family:"Arial",sans-serif;text-decoration:none">http://www.us-cert.gov/tlp/</span></b></a><o:p></o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution
or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.
<br>
<br>
. . . . .<o:p></o:p></span></p>
</div>
</body>
</html>