/
← Voltar ao feed
high critical infrastructure

SafePay ransomware has hit 600+ organizations since 2024, according to joint FBI/CISA advisory

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 03:48 · coletado há 5 horas

CISA, the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and two UK law enforcement agencies published a joint advisory on the SafePay ransomware group. The group has compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe and Australia since August 2024, and was among the most active ransomware operations in 2026. SafePay emerged in mid-2024 and operates independently without affiliates, unlike many franchise-style groups. It uses a double-extortion model, with data theft, encryption, a Tor negotiation portal, phone calls to victims and a leak site. Findings cover FBI, USSS and German investigations through August 2026.

Detalhes técnicos

  • Initial access: exposed credentials, brute force attacks (T1110) and VPN access. Actors connect from Mullvad VPN IP addresses using phished account profiles. They also exploit known flaws in edge devices: Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability and a SonicWall access control issue. The article does not list the CVE IDs.
  • Lateral movement and tooling: living-off-the-land tools rather than specialized malware: PsExec, WinRM, RDP and PowerShell. ShareFinder.ps1 is used for share discovery and Mimikatz for credential theft. AnyDesk and TeamViewer provide remote access.
  • Exfiltration: FileZilla, RClone, WinSCP and OneDrive.
  • Impact: encryption with ChaCha20 combined with RSA key exchange, tailored by file type and size. Files get the .SafePay extension and cannot be recovered without the key. The group deletes Volume Shadow Copies and resets NAS backup devices to factory settings. Ransom notes are dropped on the desktop or root directory and point to a Tor chat portal. Ransom demands are a subset of company revenue, payable in cryptocurrency.
  • The advisory ships IOC files in STIX XML and JSON, plus a full MITRE ATT&CK mapping.

Remediação

  • Keep internet-facing devices, especially VPNs and firewalls, up to date, and prioritize CISA KEV entries.
  • Enforce MFA on VPNs, webmail and accounts that access critical systems.
  • Monitor for unusual logins from Mullvad VPN IP addresses.
  • Review admin accounts, limit who can use administrative tools, use time-limited access and disable command-line tools for accounts that do not need them.
  • Keep backups offline, encrypted and immutable.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 22/10/2026 03:48 · coletado 22/10 04:00 primeiro registro

    SafePay ransomware has hit 600+ organizations since 2024, according to joint FBI/CISA advisory

    ler a análise desta fonte

    CISA, the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and two UK law enforcement agencies published a joint advisory on the SafePay ransomware group. The group has compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe and Australia since August 2024, and was among the most active ransomware operations in 2026. SafePay emerged in mid-2024 and operates independently without affiliates, unlike many franchise-style groups. It uses a double-extortion model, with data theft, encryption, a Tor negotiation portal, phone calls to victims and a leak site. Findings cover FBI, USSS and German investigations through August 2026.

    Technical Details

    • Initial access: exposed credentials, brute force attacks (T1110) and VPN access. Actors connect from Mullvad VPN IP addresses using phished account profiles. They also exploit known flaws in edge devices: Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability and a SonicWall access control issue. The article does not list the CVE IDs.
    • Lateral movement and tooling: living-off-the-land tools rather than specialized malware: PsExec, WinRM, RDP and PowerShell. ShareFinder.ps1 is used for share discovery and Mimikatz for credential theft. AnyDesk and TeamViewer provide remote access.
    • Exfiltration: FileZilla, RClone, WinSCP and OneDrive.
    • Impact: encryption with ChaCha20 combined with RSA key exchange, tailored by file type and size. Files get the .SafePay extension and cannot be recovered without the key. The group deletes Volume Shadow Copies and resets NAS backup devices to factory settings. Ransom notes are dropped on the desktop or root directory and point to a Tor chat portal. Ransom demands are a subset of company revenue, payable in cryptocurrency.
    • The advisory ships IOC files in STIX XML and JSON, plus a full MITRE ATT&CK mapping.

    Remediation

    • Keep internet-facing devices, especially VPNs and firewalls, up to date, and prioritize CISA KEV entries.
    • Enforce MFA on VPNs, webmail and accounts that access critical systems.
    • Monitor for unusual logins from Mullvad VPN IP addresses.
    • Review admin accounts, limit who can use administrative tools, use time-limited access and disable command-line tools for accounts that do not need them.
    • Keep backups offline, encrypted and immutable.