Ethical Hacking News
The FBI and CISA have warned of SafePay ransomware attacks on 600+ organizations since 2024, employing stolen credentials, VPN access, and double extortion tactics to pressure victims into paying. The group operates independently and uses common tools to move through compromised networks, making its activity harder to detect. Security teams should prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog, enable multi-factor authentication, and limit the number of accounts allowed to use administrative tools to reduce the likelihood and impact of SafePay ransomware incidents.
SafePay is a highly active ransomware group that has hit 600+ organizations since 2024. SafePay operates independently, unlike many other ransomware groups that work as franchises. The group's preferred entry points include exposed credentials, brute force password attacks, and VPN access. SafePay uses stolen account credentials, automated scripts, and known vulnerabilities to gain initial access to organizations. The group relies on common tools such as PsExec, WinRM, and PowerShell to move between systems. SafePay uses encryption with a ChaCha20 stream cipher combined with RSA for key exchange. The group demands a subset of company revenue in cryptocurrency in exchange for decryption software. SafePay runs a double-extortion model: steal first, encrypt second, threaten to post the stolen data publicly if the victim doesn't pay. The group's activity is harder to detect due to its reliance on legitimate Windows tools. Organizations are advised to keep backups offline, encrypted, and immutable, and review all accounts with admin privileges.
The cybersecurity landscape has been further complicated with the emergence of SafePay, a highly active ransomware group that has been wreaking havoc on organizations across various sectors. According to the FBI and CISA, SafePay has hit 600+ organizations since 2024, employing stolen credentials, VPN access, and double extortion tactics to pressure victims into paying.
SafePay is notable for its independent operations, which is unusual in the ransomware community. Unlike many other groups, which often work as franchises and allow other criminals to use their tools and services, SafePay operates on its own terms. This distinct approach has allowed it to grow in activity while other groups have declined. The group's preferred entry points include exposed credentials, brute force password attacks, and VPN access.
The FBI, USSS, and cybersecurity researchers have observed SafePay threat actors obtaining initial access to organizations through various means, including credential exposure, implementing brute force password attacks, and exploiting virtual private network (VPN) access. The threat actors use the IP addresses of the VPN provider "Mullvad" to attain initial access. SafePay also uses stolen account credentials and automated scripts to exploit known vulnerabilities in internet-facing devices, such as Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability, and a SonicWall access control issue.
Once inside a network, the attackers rely on common tools rather than specialized malware. They use PsExec, WinRM, RDP, and PowerShell to move between systems. A PowerShell script called ShareFinder.ps1 helps them find shared folders and identify valuable data. Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access. To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive.
Encryption uses a ChaCha20 stream cipher combined with RSA for key exchange, with methods customized based on file type and size. Files get the .SafePay extension appended. "Data encrypted with the SafePay ransomware variant (appended with .SafePay) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software." states the advisory. "SafePay threat actors leave a ransom note on the victim's system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. Paying the ransom remains the only path to decryption for encrypted files, and even that isn’t guaranteed to work."
The group runs a double-extortion model: steal first, encrypt second, threaten to post the stolen data publicly if the victim doesn’t pay. After encryption, SafePay sends victims to a Tor-based chat portal for negotiations. A representative also makes phone calls to apply pressure. If no payment comes, everything goes on the leak site. The group also deletes Volume Shadow Copies and resets network-attached backup devices to factory settings, which is the operational equivalent of cutting off every exit before the fire starts.
The advisory recommends several basic security measures. Keep internet-facing devices, especially VPNs and firewalls, up to date. Prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. Enable multi-factor authentication (MFA) for VPNs, webmail, and accounts that access critical systems. Limit the number of accounts allowed to use administrative tools. SafePay relies on legitimate Windows tools to move through compromised networks, making its activity harder to detect. Organizations should also keep backups offline, encrypted, and immutable so attackers cannot access, change, or delete them.
CISA also recommends reviewing all accounts with admin privileges, setting time-limited access where possible, and disabling command-line tools for any account that doesn’t need them.
Related Information:
https://www.ethicalhackingnews.com/articles/FBI-and-CISA-Warn-of-SafePay-Ransomware-Attacks-on-600-Organizations-ehn.shtml
https://securityaffairs.com/201464/cyber-crime/fbi-and-cisa-warn-of-safepay-ransomware-attacks-on-600-organizations.html
Published: Thu Oct 22 04:04:50 2026 by llama3.2 3B Q4_K_M
