ADVISORY: Uptick in ransomware targeting higher ed

The FBI is warning of an uptick in extortion attacks targeting higher education institutions, K–12 schools, and seminaries using the Pysa ransomware variant, also known as Mespinoza. Threat actors use Pysa to extract data and then lock affected computers. They threaten to either delete the data or publish it on the Dark Web and monetize it unless the recipient pays a ransom.

The increased attacks are occurring across the U.S. and the U.K. Criminals have used Pysa to steal employment records containing personally identifiable information, payroll tax information, and other sensitive information.

How Pysa Infects Computers

• Through phishing emails that lure recipients into opening an attachment or shared document containing the ransomware.
• By remotely accessing systems via compromised credentials.

What Unit IT Staff Can Do

• If you have not already installed CrowdStrike Falcon endpoint protection on the unit computers you are responsible for, do so as soon as possible. Falcon protects against this and other threats.
• Implement Duo two-factor on any machine that allows authenticated connections from the internet.
• Back up U-M data. All U-M units and research programs are required to develop and document backup plans for U-M institutional data.
• Keep hardware and software up-to-date. Apply all patches and updates as soon as possible after appropriate testing, and only use supported, up-to-date software.
• Report suspected IT security incidents, including ransomware attacks, to [email protected].
• Provide education and awareness in your unit:
  • Post this print-and-post flyer: Beware of Ransomware!
  • Post one of our ransomware digital signs (U-M login required).
  • Share this Safe Computing webpage: Ransomware: Don't Pay the Ransom!

Learn more at Ransomware Mitigation.

What Users Can Do

Most importantly:

• Do not open unexpected attachments and shared documents.
• Report suspected IT security incidents, including ransomware, to [email protected]. For details about incidents and reporting, see the video at Report an IT Security Incident.

Learn more:

• See Ransomware: Don't Pay the Ransom! for additional tips.
• Check out this print-and-post flyer: Beware of Ransomware!