THE SafePay ransomware group has compromised at least 600 critical infrastructure organisations worldwide, according to a joint advisory from US, German and UK government agencies led by CISA. Since first appearing in August 2024, SafePay has impacted a broad range of sectors across North America, South America, Europe and Australia.
The advisory details a wide array of initial access techniques used by SafePay, including credential exposure, brute-force password attacks, VPN exploitation and edge device vulnerabilities. After gaining entry, the group moves laterally to obtain administrative privileges, using living-off-the-land methods and tools such as PsExec, WinRM and RMM software, and often leverages RDP to expand presence. They are noted for disabling security software and for concealing their code with software packing or VM protection.
For data exfiltration, SafePay reportedly uses legitimate file transfer tools like FileZilla, OneDrive, 7-Zip, RClone and WinRAR. Victims then face a double-extortion approach: a ransom note with a TOR chat portal, a victim ID login and a demand in cryptocurrency, with pressure amplified by a phone call from the group. If pay is refused, the exfiltrated data is posted to a leak site.
The advisory recommends prioritising remediation of known exploited vulnerabilities, enforcing MFA and ICAM across all accounts, maintaining offline backups, encrypting and preserving backups immutably, segmenting networks, and deploying network monitoring to detect anomalous activity and potential traversal.