Mespinoza Ransomware Gang Calls Victims “Partners,” Attacks with Gasket, "Magic Socks" Tools
Summary: Unit 42 observed the Mespinoza ransomware gang, also known as PYSA, attacking U.S. publishing, real estate, industrial manufacturing and education organizations with ransom demands as high as $1.6 million and payments as high as $470,000. The group's leak site listed 187 victim organizations across more than 20 countries, with 55 percent in the United States, and its tools include a Go-language backdoor called Gasket and a tunneling tool called MagicSocks.
Bottom line: The gang studies a network before striking, searching for files matching keywords like "ssn," "passport," "fraud" and "SWIFT" so it can exfiltrate the data that would hurt most if leaked - and it has already named 187 organizations on its leak site.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·