US, UK and Germany Warn SafePay Ransomware Has Hit at Least 600 Victims
Summary
A joint U.S., U.K. and German advisory says SafePay has compromised at least 600 victims since August 2024, using stolen credentials and exploited vulnerabilities to steal data and encrypt systems.
Key points
- The agencies say SafePay has targeted businesses and critical infrastructure worldwide, compromising at least 600 victims since August 2024.
- SafePay gains access through compromised credentials, brute-force attacks and vulnerabilities in Cisco, Veeam and SonicWall products, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
- The group uses administrative accounts and built-in Windows tools such as PsExec and Windows Remote Management to establish persistence and move through networks.
- SafePay identifies files for theft, collects them with tools including 7-Zip and RClone, and transfers data before encrypting systems—sometimes within 24 hours of theft.
- The ransomware uses ChaCha20 and RSA encryption and appends the .safepay extension to affected files.
- Huntress says SafePay’s ransomware binary shares command-line flags and encryption logic with leaked LockBit Black source code, while adding features including a Cyrillic-language kill switch.
- The agencies say SafePay actors use the Mullvad VPN service to conceal their IP addresses; firms suspect the group is based in Russia, but this is not confirmed.
Article Details
- Attack Vectors
- SafePay gains initial access using compromised credentials, brute-force password attacks, and exploitation of VPN and edge-device vulnerabilities.
- The group exploits vulnerabilities in Cisco Adaptive Security Appliance and Firepower Threat Defense, Veeam software, and SonicWall products to access victim networks.
- After access, SafePay uses administrative privileges on existing or newly created accounts, built-in Windows tools, and User Account Control bypasses to persist and escalate privileges.
- The group enumerates shared folders and network-accessible storage, moves laterally, exfiltrates data, and encrypts victim files—typically within 24 hours of data theft.
- Defensive Notes
- Review and secure VPN and edge-device exposure, and address the vulnerabilities identified in Cisco, Veeam, and SonicWall products.
- Monitor for compromised credentials, brute-force activity, unexpected administrative account changes, and suspicious use of PsExec, Windows Remote Management, and PowerShell.
- Monitor for unusual shared-folder enumeration, lateral movement, data collection and transfer using compression or file-transfer tools, and rapid file encryption.
MITRE ATT&CK
T1021.006 · Windows Remote ManagementSafePay uses Windows Remote Management to remotely execute commands and move through victim networks.T1059.001 · PowerShellA PowerShell script function is used to enumerate shared folders and network-accessible storage.T1078 · Valid AccountsSafePay uses compromised credentials and stolen phishing accounts to authenticate to victim networks.T1098 · Account ManipulationSafePay establishes persistence by gaining administrative privileges on existing accounts.T1110 · Brute ForceThe advisory reports that SafePay gains initial access through brute-force password attacks.T1133 · External Remote ServicesThe group exploits VPN vulnerabilities and establishes clientless SSL VPN sessions to access victim networks.T1135 · Network Share DiscoverySafePay enumerates shared folders and other network-accessible storage locations.T1136 · Create AccountSafePay establishes persistence using newly created accounts with administrative privileges.T1190 · Exploit Public-Facing ApplicationSafePay exploits vulnerabilities in VPN and edge devices, including Cisco, Veeam, and SonicWall products, to gain access.T1486 · Data Encrypted for ImpactSafePay encrypts victim files using hybrid ChaCha20 and RSA encryption and appends the .safepay extension.T1548.002 · Bypass User Account ControlThe group abuses User Account Control mechanisms to escalate privileges to administrator level.T1560.001 · Archive via UtilitySafePay compresses and collects data with tools including 7-Zip and WinRAR before exfiltration.T1567.002 · Exfiltration to Cloud StorageThe article reports that SafePay sometimes uses OneDrive to send exfiltrated data.T1569.002 · Service ExecutionSafePay uses PsExec to remotely execute commands.
CVE
CVE-2020-3259and Firepower Threat Defense that provide firewall and VPN services. One vulnerability, tracked as CVE-2020-3259, could allow attackers to retrieve sensitive information from an affected devices' memory. The otherCVE-2023-20269to retrieve sensitive information from an affected devices' memory. The other flaw, assigned CVE-2023-20269, could allow unauthorized users to establish clientless SSL VPN sessions.CVE-2023-27532also found SafePay exploiting two vulnerabilities in data backup software Veeam. One flaw, tracked as CVE-2023-27532, could allow attackers to obtain encrypted credentials from the configuration database and gainCVE-2024-40711configuration database and gain access to backup infrastructure hosts. The other one, cataloged as CVE-2024-40711, is a high-severity deserialization vulnerability that could allow remote code execution.CVE-2024-40766Another vulnerability in firewall and VPN provider SonicWall, assigned CVE-2024-40766, is also used to gain unauthorized access.
Threat Actors
Malware
Vendors
CiscoTo gain initial access, they exploit edge device flaws in Cisco security software Adaptive Security Appliance and Firepower Threat Defense that provide firewall and VPN services. One vulnerability, tracked asMicrosoftsuch as FileZilla, 7-Zip, RClone and WinRAR, and uses file transfer tools WinSCP and RClone - sometimes Microsoft's OneDrive - to send data to actor-controlled accounts.MullvadSafePay actors route their connections through commercial VPN service Mullvad to conceal their actual IP addresses when accessing victim networks and rely on accounts stolen from phishing to authenticate.SonicWallAnother vulnerability in firewall and VPN provider SonicWall, assigned CVE-2024-40766, is also used to gain unauthorized access.VeeamThe agencies also found SafePay exploiting two vulnerabilities in data backup software Veeam. One flaw, tracked as CVE-2023-27532, could allow attackers to obtain encrypted credentials from the configuration database
Products
Adaptive Security ApplianceTo gain initial access, they exploit edge device flaws in Cisco security software Adaptive Security Appliance and Firepower Threat Defense that provide firewall and VPN services. One vulnerability, tracked asFirepower Threat Defensethey exploit edge device flaws in Cisco security software Adaptive Security Appliance and Firepower Threat Defense that provide firewall and VPN services. One vulnerability, tracked as CVE-2020-3259, could allowMicrosoft OneDrive7-Zip, RClone and WinRAR, and uses file transfer tools WinSCP and RClone - sometimes Microsoft's OneDrive - to send data to actor-controlled accounts.Microsoft WindowsThe group uses legitimate Windows administration tools, including PsExec and Windows Remote Management, to remotely execute commands.SonicWallAnother vulnerability in firewall and VPN provider SonicWall, assigned CVE-2024-40766, is also used to gain unauthorized access.VeeamThe agencies also found SafePay exploiting two vulnerabilities in data backup software Veeam. One flaw, tracked as CVE-2023-27532, could allow attackers to obtain encrypted credentials from the configuration database
Tools
7-Zipexfiltration and encryption. It compresses and collects data with legitimate tools, such as FileZilla, 7-Zip, RClone and WinRAR, and uses file transfer tools WinSCP and RClone - sometimes Microsoft's OneDrive - toFileZillafiles for exfiltration and encryption. It compresses and collects data with legitimate tools, such as FileZilla, 7-Zip, RClone and WinRAR, and uses file transfer tools WinSCP and RClone - sometimes Microsoft'sPowerShellIn several instances, it used a PowerShell script function to enumerate shared folders and other network-accessible storage locations in Windows Active Directory environments to identify valuable assets for exfiltration.PsExecThe group uses legitimate Windows administration tools, including PsExec and Windows Remote Management, to remotely execute commands.RCloneand encryption. It compresses and collects data with legitimate tools, such as FileZilla, 7-Zip, RClone and WinRAR, and uses file transfer tools WinSCP and RClone - sometimes Microsoft's OneDrive - to sendWindows Remote ManagementThe group uses legitimate Windows administration tools, including PsExec and Windows Remote Management, to remotely execute commands.WinRARencryption. It compresses and collects data with legitimate tools, such as FileZilla, 7-Zip, RClone and WinRAR, and uses file transfer tools WinSCP and RClone - sometimes Microsoft's OneDrive - to send data toWinSCPdata with legitimate tools, such as FileZilla, 7-Zip, RClone and WinRAR, and uses file transfer tools WinSCP and RClone - sometimes Microsoft's OneDrive - to send data to actor-controlled accounts.
Countries
Germanyand exploitation of VPN vulnerabilities, the Federal Bureau of Investigation, U.S. Secret Service and Germany's Landeskriminalamt Rheinland-Pfalz reported.RussiaMany cybersecurity firms suspect SafePay is based in Russia. "The group does not allow targeting of Commonwealth of Independent States," said U.K.-based Quorum Cyber. "This is commonly a trait of groups based within
Industries
BiotechnologyThe ransomware group posted 13 breaches in the first 12 days of October on its data leak site, with victims including a U.S. biotechnology firm to a Swiss hotel and a German construction company.ConstructionThe ransomware group posted 13 breaches in the first 12 days of October on its data leak site, with victims including a U.S. biotechnology firm to a Swiss hotel and a German construction company.Critical infrastructureCritical Infrastructure Security