Joint Advisory Details SafePay Ransomware Tactics After at Least 600 Victims
Summary
A joint advisory from CISA, the FBI and international partners says SafePay ransomware has affected at least 600 victims. It details credential-based intrusions, vulnerability exploitation, data theft, backup destruction and encryption.
Key points
- The authoring agencies report at least 600 victims across multiple critical infrastructure sectors, with operations spanning the Americas, Europe and Australia since August 2024.
- Initial access methods include exposed or phished credentials, brute-force password attacks, VPN access and exploitation of internet-facing systems.
- Attackers establish administrative access through existing or newly created accounts, use PsExec, WinRM and RDP for lateral movement, and enumerate network shares with ShareFinder.ps1 and SharpShares.exe.
- SafePay actors disable security protections and exfiltrate data using tools and services including WinSCP, RClone, OneDrive and Backblaze B2.
- Before encryption, actors inhibit recovery by stopping the Volume Shadow Copy Service and, in observed cases, resetting network-attached backup storage to factory settings.
- The ransomware combines ChaCha20 and RSA encryption and appends .SafePay to encrypted files. Actors demand cryptocurrency payments and publish stolen data when victims do not pay.
- Agencies recommend prioritizing patches for exposed systems, enforcing MFA and least privilege, segmenting networks, and maintaining tested offline, immutable backups. Historical IP indicators require corroboration before blocking.
Article Details
- Attack Vectors
- The authoring agencies report initial access through exposed credentials, brute-force password attacks, phished account profiles, and exploitation of internet-exposed systems using automated scripts.
- SafePay actors establish persistence by granting administrative privileges to existing accounts or creating new accounts.
- Actors use remote administration utilities and RDP for lateral movement, enumerate network shares, and collect credentials to expand access.
- Actors archive and exfiltrate data to actor-controlled accounts before encrypting files and threatening publication of stolen data.
- Actors disable security protections, halt the Volume Shadow Copy Service, and reset network-attached backup storage to impede detection and recovery.
- Defensive Notes
- Prioritize patching known exploited vulnerabilities in internet-facing systems, especially firewalls and other edge devices.
- Require MFA, enforce strong unique passwords and failed-login lockouts, and restrict administrative privileges using least privilege and time-limited access.
- Maintain offline, encrypted, immutable backups and regularly test restoration procedures.
- Segment networks, restrict access to remote services, and monitor lateral connections and unexpected administrative or scripting activity.
- Review accounts for unauthorized creation or privilege changes and investigate unexpected deployment of legitimate remote administration and data-transfer utilities.
- If compromise is suspected, isolate affected hosts and collect sufficient logs and artifacts to scope the intrusion and inform containment and eviction.
- The advisory's infrastructure indicators were observed between November 2024 and August 2026. Corroborate them with current telemetry before blocking because infrastructure may be shared or reassigned.
- The authoring agencies discourage ransom payments because payment does not guarantee recovery.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 173[.]194[.]194[.]94 | Listed by the advisory as infrastructure hosting victim data in SafePay activity. |
| IPV4 | 37[.]10[.]71[.]188 | Listed as an IP address used for exfiltration in SafePay intrusions. |
| IPV4 | 5[.]255[.]11[.]134 | Listed as an IP address used for exfiltration in SafePay intrusions. |
| IPV4 | 88[.]119[.]167[.]239 | Listed as the command-and-control address for soc.dll. |
| SHA1 | 07353237350c35d6dc2c8f143b649cd07c71f62b | SHA-1 of 1.exe, explicitly identified as a ransomware binary. |
| SHA1 | b498a2683640c983bb069fa2ea9e67cef4a3797d | SHA-1 of Locker.dll, a PE32 executable listed among SafePay indicators. |
| SHA1 | bbfed53e3bb1f306f4da97d995cf4ae5b73ad081 | SHA-1 of locker.dll listed among SafePay indicators. |
| SHA256 | 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 | SHA-256 of locker.dll, a PE32 executable listed among SafePay indicators. |
| SHA256 | 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a | SHA-256 of a RunPE bundled DLL listed among SafePay indicators. |
| SHA256 | 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae | SHA-256 of soc.dll, associated in the advisory with command-and-control infrastructure. |
| SHA256 | a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 | SHA-256 of locker.dll listed among SafePay indicators. |
| SHA256 | e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346 | SHA-256 of an injected PE listed among SafePay indicators. |
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesActors use PsExec and SMB access to execute commands remotely and move laterally.T1021.006 · Windows Remote ManagementActors use WinRM to execute commands on remote systems within compromised networks.T1027.002 · Software PackingActors use software packing or virtual machine software protection to conceal their code.T1059.001 · PowerShellActors execute ShareFinder.ps1 through PowerShell to locate network shares containing valuable data.T1070.004 · File DeletionSafePay may delete itself from the victim filesystem after encryption.T1098 · Account ManipulationActors establish persistence by granting administrative privileges to existing accounts.T1110 · Brute ForceSafePay actors use brute-force password attacks to obtain initial access.T1135 · Network Share DiscoveryShareFinder.ps1 and SharpShares.exe enumerate network file shares for exfiltration hunting.T1136 · Create AccountActors create accounts to maintain access and support movement through compromised networks.T1190 · Exploit Public-Facing ApplicationThe authoring agencies observed automated scripts exploiting vulnerabilities in internet-exposed systems for initial access.T1486 · Data Encrypted for ImpactSafePay encrypts files using ChaCha20 and RSA, supports full or partial encryption, and appends .SafePay to encrypted files.T1490 · Inhibit System RecoveryActors halt the Volume Shadow Copy Service and factory-reset network-attached storage containing victim backups.T1548.002 · Bypass User Account ControlActors bypass UAC through a specified component object model to create an elevated process and execute malicious commands or binaries.T1560.001 · Archive via UtilityActors use archiving utilities including 7-Zip and WinRAR to package collected data before exfiltration.T1567 · Exfiltration Over Web ServiceThe advisory reports instances of actors exfiltrating victim data through OneDrive.
CVE
CVE-2020-3259CVE-2020-3259 [Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor]CVE-2023-20269CVE-2023-20269 [CWE-288: Authentication Bypass Using an Alternate Path or Channel]CVE-2023-27532CVE-2023-27532 [CWE-306: Missing Authentication for Critical Function]CVE-2024-40711CVE-2024-40711 [CWE-502: Deserialization of Untrusted Data]CVE-2024-40766CVE-2024-40766 [CWE-284: Improper Access Control]
Threat Actors
Malware
Vendors
BackblazeA command-line tool for file management within Backblaze B2 cloud storage. SafePay threat actors executed commands via b2.exe to exfiltrate a victim’s data.MullvadSafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known
Products
AcronisDiskDirectorAcronisDiskDirector-12.5 / acro.exe / DiskDirector.exe / Acronis.exeAnyDeskIn other instances, the SafePay threat actors installed legitimate remote desktop tools like AnyDesk or TeamViewer on the victim’s systems.Microsoft OneDriveIn some instances, SafePay threat actors use OneDrive to exfiltrate data [T1567].ScreenConnectA remote support, access, and meeting software that allows users to control devices remotely over the internet. SafePay threat actors use ScreenConnect for persistence and access.TeamViewerIn other instances, the SafePay threat actors installed legitimate remote desktop tools like AnyDesk or TeamViewer on the victim’s systems.
Tools
7-ZipSafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [T1560.001], and WinSCP and RClone to facilitate the exfiltration of data [T1048] from theFileZillaSafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [T1560.001], and WinSCP and RClone to facilitate the exfiltration of data [T1048] from theMimikatzA credential dumper that enables users to view and save authentication credentials, such as Kerberos tickets [T1550.002]. SafePay threat actors use Mimikatz for password exfiltration.NetExecThe executable for NetExec, a legitimate network assessment tool used to enumerate systems, validate credentials, and manage remote operations across private networks.PsExecactors establish a foothold in a victim’s network, they use LOTL binaries (LOLBins) [T1218], such as PsExec [T1021.002] and Windows Remote Management (WinRM) [T1021.006], to execute commands on remote systems.RCloneSafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [T1560.001], and WinSCP and RClone to facilitate the exfiltration of data [T1048] from theShareFinder.ps1In several instances, SafePay threat actors used ShareFinder.ps1—a PowerShell script function used for enumerating network file shares in Windows Active Directory environments—to identify valuable assets forSharpSharesAdditionally, SafePay threat actors used SharpShares.exe, a tool used to identify and enumerate network file shares.WinRARSafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [T1560.001], and WinSCP and RClone to facilitate the exfiltration of data [T1048] from theWinSCPtools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [T1560.001], and WinSCP and RClone to facilitate the exfiltration of data [T1048] from the compromised network to