SafePay Ransomware Group

Overview

Timeline

1. Aug 2024

   The advisory says SafePay has been highly active since August 2024.

2. Nov 2024 to Aug 2026

   The period in which the advisory's indicators of compromise were observed.

3. 20 Oct 2026

   The FBI, CISA and partners publish joint advisory AA26-293A, which counts at least 600 separate victims.

How they get in

1. 01

   Stolen or guessed passwords

   The advisory says actors typically get in by stealing or guessing passwords. It lists credential exposure and brute force (T1110). It also lists phished account profiles and VPN access from IP addresses of the Mullvad VPN provider.

2. 02

   Cisco ASA and FTD: CVE-2020-3259 and CVE-2023-20269

   The advisory describes edge device exploitation after phished account profiles gave access. CVE-2020-3259 lets an unauthenticated attacker read device memory through the web services interface. CVE-2023-20269 allows brute force against remote access VPN accounts. Cisco lists fixed ASA releases such as 9.8.4.20 and 9.12.3.9 for the first flaw and says enabling MFA reduces the risk of the second.

3. 03

   Veeam Backup & Replication: CVE-2023-27532 and CVE-2024-40711

   The advisory says both were exploited on internet-exposed systems with automated scripts (T1190). Veeam fixed the first in builds 12.0.0.1420 and 11.0.1.1261, and the second, an unauthenticated remote code execution flaw, in version 12.2 (build 12.2.0.334).

4. 04

   SonicWall SonicOS: CVE-2024-40766

   The advisory says it was exploited on internet-exposed systems with automated scripts (T1190). The CVE record describes improper access control in SonicOS management access. It affects Gen 5 devices on SonicOS 5.9.2.14-12o and older, Gen 6 devices on 6.5.4.14-109n and older, and Gen 7 devices on 7.0.1-5035 and older. The fixed builds are in SonicWall advisory SNWLID-2024-0015.

How they extort

Techniques

• Technique Archive Collected Data Archive collected data is when an attacker packs stolen files into compressed or encrypted bundles before sending them out. T1560 · Collection
• Technique Command and Scripting Interpreter Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs. T1059 · Execution
• Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
• Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
• Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
• Technique Indicator Removal Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind. T1070 · Stealth
• Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement

How to defend

1. Patch known exploited flaws on internet-facing systems first

   Start with the five flaws: Cisco ASA and FTD, Veeam Backup & Replication and SonicWall SonicOS. The advisory tells defenders to prioritize patching flaws in the CISA catalog, especially on internet-facing systems.

2. Require MFA on VPN, webmail and critical accounts

   The advisory asks for multifactor authentication, especially for webmail, VPNs and accounts on critical systems. Cisco says MFA reduces the risk from CVE-2023-20269.

3. Use long passwords and lockouts

   The advisory recommends passwords of 15 to 64 characters, no reuse and account lockout after failed attempts.

4. Keep encrypted, immutable, offline backups

   Actors deleted network-attached backups, so keep copies that are physically separate, and test the restore.

5. Segment the network and watch for lateral movement

   The advisory recommends network segmentation and EDR tools that detect lateral movement, plus a review of domain controllers, servers and Active Directory for accounts nobody recognises.

6. Watch for data leaving the network

   Exfiltration tools in the advisory include RClone, WinSCP, FileZilla, Backblaze b2.exe and OneDrive. Alert on their use where you do not expect it.