Attacks involving the Mespinoza/Pysa ransomware

ANSSI describes recent opportunistic ransomware attacks targeting French local authorities leveraging Mespinoza/Pysa variants (Windows executable and Python .pyz) and a third PowerShell-based strain; the report includes sample filenames and hashes, ransom note characteristics, and observed TTPs such as RDP brute-force, PsExec, PowerShell scripts, credential theft (Mimikatz), post-exploitation tools (Empire), and a Go-based RAT, concluding these are financially motivated intrusions with significant impact on affected organisations.