Inside SafePay: Analyzing the New Centralized Ransomware Group

Summary

SafePay is a recently surfaced ransomware operation that appears to run as a tightly controlled, centralized group rather than a typical Ransomware-as-a-Service ecosystem. The actors follow a double-extortion playbook, staging sensitive data ahead of encryption and threatening publication via a Tor-based leak site. Delivery commonly involves a native Windows DLL, with execution and propagation supported by widely available living-off-the-land utilities. In observed cases, the end-to-end timeline is aggressive, frequently compressing initial access through environment-wide encryption into roughly a 24-hour window.

Investigation

Researchers report that SafePay often secures entry through exposed VPN or RDP accounts using stolen or guessed credentials, and in some scenarios abuses misconfigured FortiGate deployments—particularly environments lacking MFA. For persistence, operators have been observed deploying backdoors such as QDoor and leveraging legitimate remote administration tooling, including ScreenConnect, to blend into normal IT activity. Lateral movement is typically driven through PsExec and WinRM, while host and share discovery is supported by a bespoke PowerShell utility (ShareFinder.ps1). Prior to encryption, the payload performs “pre-ransom” actions designed to maximize impact and hinder recovery: it removes shadow copies, alters boot configuration settings, and terminates a hard-coded set of security-related processes and services.

Mitigation

Require MFA across all remote access pathways and reduce firewall risk by restricting local account authentication and tightening administrative exposure. Monitor for anomalous use of PsExec, WinRM, regsvr32, and rundll32—especially in sequences consistent with remote execution and staging. Tune endpoint detections to surface termination of common security tooling, deletion of shadow copies, and changes to BCD/boot settings. Reduce execution opportunities by blocking or tightly controlling unsigned DLL loading and enforcing application control policies across endpoints and servers.

Response

When SafePay indicators are identified, isolate affected systems immediately, capture volatile memory, and preserve relevant authentication, endpoint, and network logs. Identify and block associated command-and-control infrastructure, then terminate malicious processes and remove persistence mechanisms. Attempt recovery actions such as restoring shadow copies where feasible, but assume data theft may have occurred and validate exfiltration scope. Complete a full forensic review to determine impacted data and execute stakeholder notifications and escalation steps aligned to double-extortion response procedures.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary with Domain Administrator credentials compromises a pivot machine and uses PsExec to launch a remote cmd.exe on a secondary host (TARGET_IP). Immediately after establishing the remote shell, the attacker transfers a malicious DLL (malicious.dll) to the remote host and loads it using regsvr32.exe (alternatively rundll32.exe) to execute the ransomware payload. The sequence produces two distinct process‑creation events that satisfy the Sigma rule: a PsExec process with the exact command line and a subsequent DLL loader process.

• Regression Test Script:

  # -------------------------------------------------------------------------
  # SafePay Ransomware Simulation – PsExec + Regsvr32
  # -------------------------------------------------------------------------
  # Prerequisites:
  #   - PsExec.exe in the current directory or in PATH
  #   - A malicious DLL named malicious.dll placed in the same folder
  #   - Valid domain admin credentials (replace placeholders)
  # -------------------------------------------------------------------------
  
  $targetIP   = "10.0.0.20"            # <--- CHANGE TO YOUR TARGET
  $username   = "DomainAdmin"        # <--- CHANGE TO VALID USER
  $password   = "Password123!"        # <--- CHANGE TO VALID PASSWORD
  $dllPath    = "$PSScriptRootmalicious.dll"
  
  # 1) Execute remote cmd.exe via PsExec
  Write-Host "[*] Launching remote cmd.exe via PsExec..."
  $psexecArgs = "\$targetIP -u $username -p $password cmd.exe"
  & .PsExec.exe $psexecArgs
  
  Start-Sleep -Seconds 5  # give remote session time to start
  
  # 2) Copy the malicious DLL to the remote host (using SMB)
  Write-Host "[*] Copying malicious DLL to remote host..."
  $destPath = "\$targetIPC$Tempmalicious.dll"
  Copy-Item -Path $dllPath -Destination $destPath -Force
  
  # 3) Load the DLL via regsvr32 (this generates the second event)
  Write-Host "[*] Loading malicious DLL with regsvr32..."
  $regsvrArgs = "/s $destPath"
  & regsvr32.exe $regsvrArgs
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  # -------------------------------------------------------------------------
  # Cleanup for SafePay Simulation
  # -------------------------------------------------------------------------
  $targetIP = "10.0.0.20"
  $dllRemote = "\$targetIPC$Tempmalicious.dll"
  
  # Remove the malicious DLL from the remote host
  Write-Host "[*] Removing malicious DLL from remote host..."
  Remove-Item -Path $dllRemote -Force -ErrorAction SilentlyContinue
  
  # Optionally terminate any lingering regsvr32/rundll32 processes
  Get-Process -Name regsvr32, rundll32 -ErrorAction SilentlyContinue |
      Where-Object {$_.Path -like "*$targetIP*"} |
      Stop-Process -Force
  
  Write-Host "[+] Cleanup complete."