Joint Advisory Details SafePay Ransomware Tactics and at Least 600 Victims
Summary
A joint U.S., U.K., and German advisory says SafePay ransomware has affected at least 600 victims. It details credential-based access, vulnerability exploitation, data theft, backup destruction, and encryption, alongside mitigation guidance.
Key points
- The October 20 advisory draws on investigations through August 2026 and reports at least 600 victims across multiple critical infrastructure sectors.
- SafePay gains access through exposed or phished credentials, brute-force attacks, and exploitation of internet-facing systems, including CVE-2020-3259 and CVE-2023-20269.
- Actors establish administrative accounts or modify existing ones, disable security software, and use PsExec, WinRM, and RDP for execution and lateral movement.
- ShareFinder.ps1 and SharpShares.exe identify network shares; tools including RClone, WinSCP, OneDrive, and Backblaze B2 support data exfiltration.
- Actors stop Volume Shadow Copy Service and factory-reset network-attached backup storage to hinder recovery before encrypting files with ChaCha20 and RSA and appending .SafePay.
- Extortion includes cryptocurrency demands, pressure calls, and publication of stolen data when victims do not pay.
- Agencies recommend patching exposed systems, requiring MFA, restricting privileges, and maintaining tested offline and immutable backups; historical IP indicators require corroboration before blocking.
Article Details
- Attack Vectors
- Initial access through exposed credentials, brute-force password attacks, phished account profiles, and VPN access.
- Exploitation of known vulnerabilities in edge devices and internet-exposed systems, including automated exploitation scripts.
- Persistence through administrative privileges on existing accounts or newly created accounts.
- Remote command execution and lateral movement using administrative utilities, remote management software, and RDP.
- Collection and compression of valuable files followed by exfiltration to actor-controlled accounts.
- Backup disruption and hybrid ChaCha20/RSA file encryption, followed by cryptocurrency ransom demands and threats to publish stolen data.
- Defensive Notes
- Prioritize patching known exploited vulnerabilities in internet-facing systems, firewalls, and other edge devices.
- Require MFA, particularly for VPNs and privileged accounts; enforce strong, unique passwords and failed-login lockouts.
- Restrict administrative privileges, audit unfamiliar accounts, and consider time-limited privileged access.
- Maintain tested offline, encrypted, immutable backups in a separate, segmented location.
- Segment networks, restrict remote-service access from untrusted origins, and monitor lateral connections with network and endpoint telemetry.
- Restrict unnecessary command-line and scripting permissions.
- If compromise is suspected, isolate affected hosts, collect artifacts, scope the intrusion, and develop an evidence-informed eviction plan.
- Corroborate the advisory's historical indicators with current telemetry before blocking; infrastructure may have been reassigned.
- Validate defenses against the reported behaviors through repeated security-control testing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]26[.]2[.]223 | Listed as associated with SafePay victim intrusion during the November 2024–August 2026 observation window; verify current use before blocking. |
| IPV4 | 140[.]82[.]114[.]4 | Listed as associated with SafePay victim intrusion; the advisory cautions that historical infrastructure may subsequently serve benign activity. |
| IPV4 | 173[.]194[.]194[.]94 | Identified as hosting victim data in the SafePay infrastructure table; treat as a historical indicator requiring verification. |
| IPV4 | 185[.]199[.]108[.]133 | Listed as associated with SafePay victim intrusion; corroboration with current telemetry is recommended. |
| IPV4 | 37[.]10[.]71[.]188 | IP address used for exfiltration in SafePay activity. |
| IPV4 | 5[.]255[.]11[.]134 | IP address used for exfiltration in SafePay activity. |
| IPV4 | 77[.]37[.]49[.]40 | IP address associated with SafePay victim intrusion in the advisory. |
| IPV4 | 88[.]119[.]167[.]239 | Command-and-control IP address for soc.dll. |
| SHA1 | 07353237350c35d6dc2c8f143b649cd07c71f62b | Hash of 1.exe, identified as a ransomware binary. |
| SHA1 | b498a2683640c983bb069fa2ea9e67cef4a3797d | Hash of Locker.dll, a PE32 executable listed among SafePay-associated artifacts. |
| SHA1 | bbfed53e3bb1f306f4da97d995cf4ae5b73ad081 | Hash of locker.dll listed among SafePay-associated artifacts. |
| SHA256 | 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 | Hash of locker.dll, a PE32 executable listed among SafePay-associated artifacts. |
| SHA256 | 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a | Hash of a RunPE bundled DLL listed as a SafePay-associated indicator. |
| SHA256 | 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae | Hash of soc.dll, whose command-and-control infrastructure is identified in the advisory. |
| SHA256 | a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 | Hash of locker.dll listed among SafePay-associated artifacts. |
| SHA256 | e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346 | Hash of an injected PE listed as a SafePay-associated indicator. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolActors use RDP to expand their presence within compromised networks.T1021.006 · Windows Remote ManagementActors use WinRM to execute commands on remote systems.T1059.001 · PowerShellActors execute ShareFinder.ps1 to enumerate network shares and identify valuable assets for exfiltration.T1070.004 · File DeletionSafePay may delete itself from the victim filesystem after encryption.T1098 · Account ManipulationActors establish persistence by gaining administrative privileges on existing accounts.T1110 · Brute ForceSafePay actors use brute-force password attacks to obtain initial access.T1133 · External Remote ServicesSafePay actors use VPN access and external remote services to enter victim networks.T1136 · Create AccountActors create new accounts to establish persistence and support access within compromised networks.T1190 · Exploit Public-Facing ApplicationThe authoring agencies observed automated exploitation of vulnerabilities in internet-exposed systems for initial access.T1486 · Data Encrypted for ImpactSafePay encrypts files using a hybrid ChaCha20/RSA scheme and appends .SafePay before ransom demands.T1490 · Inhibit System RecoveryActors halt the Volume Shadow Copy Service and factory-reset network-attached storage holding victim backups.T1548.002 · Bypass User Account ControlActors bypass UAC by creating an elevated process through a specified component object model to execute malicious commands or binaries.T1560.001 · Archive via UtilityActors use 7-Zip and WinRAR to compress stolen data, including splitting data into RAR segments before exfiltration.T1567 · Exfiltration Over Web ServiceActors use OneDrive to exfiltrate victim data in some incidents.T1569.002 · Service ExecutionActors use PsExec to execute commands on remote systems.
CVE
Threat Actors
Malware
Vendors
Products
7-ZipSafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress filesAcronisDiskDirectorAcronisDiskDirector-12.5 / acro.exeAnyDeskremote desktop tools like AnyDesk or TeamViewer on the victim’s systems. SafePay threat actors use theseBackblaze B2A command-line tool for file management within Backblaze B2 cloud storage.FileZillaSafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress filesMicrosoft OneDriveOneDrive to exfiltrate data [T1567]. In other instances, the SafePay threat actors installed legitimateScreenConnectremotely over the internet. SafePay threat actors use ScreenConnect for persistenceTeamViewerremote desktop tools like AnyDesk or TeamViewer on the victim’s systems. SafePay threat actors use theseWinRARSafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress filesWinSCPand collect data [T1560.001], and WinSCP and RClone to facilitate the exfiltration of data [T1048] from
Tools
Mimikatzsuch as Kerberos tickets [T1550.002]. SafePay threat actors use Mimikatz forNetExecThe executable for NetExec, a legitimate network assessment toolPsExecestablish a foothold in a victim’s network, they use LOTL binaries (LOLBins) [T1218], such as PsExecRCloneSafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress filesShareFinder.ps1systems. In several instances, SafePay threat actors used ShareFinder.ps1—a PowerShell script functionSharpSharesSharpShares.exe, a tool used to identify and enumerate network file shares.