SafePay Ransomware: Tactics, Techniques, and Defensive Measures

Summary

SafePay ransomware actors target businesses and critical infrastructure through credential theft, phishing, and exploitation of known vulnerabilities. They maintain persistence by manipulating administrative accounts and rely on living-off-the-land techniques for lateral movement. The attack typically ends with data exfiltration followed by hybrid ChaCha20-RSA encryption and cryptocurrency ransom demands.

Investigation

The investigation was conducted jointly by the FBI, USSS, CISA, Germany’s Landeskriminalamt Rheinland-Pfalz, and the UK’s NCA and NWROCU. The findings are based on investigations carried out through August 2026. Since August 2024, SafePay actors have affected at least 600 victims across multiple industries and critical sectors.

Mitigation

Organizations should prioritize patching known exploited vulnerabilities, particularly those affecting edge devices and firewalls. Applying Zero Trust principles, multifactor authentication (MFA), and strong identity and access management (ICAM) controls is essential. Maintaining immutable offline backups and enforcing network segmentation can also substantially reduce the potential impact of ransomware attacks.

Response

When SafePay activity is detected, organizations should isolate compromised systems and conduct threat hunting to determine the full scope of the intrusion. Incidents should be reported to relevant law enforcement agencies, including the FBI or IC3. After containment, apply eviction strategies to remove the threat and strengthen affected environments to prevent re-entry.

Simulation Execution

• Attack Narrative & Commands: The adversary has gained initial access and is performing internal reconnaissance to identify high-value user accounts for lateral movement. Following the SafePay ransomware playbook, the attacker executes a specialized PowerShell script named ShareFinder.ps1 to map network shares and then utilizes the net user command via cmd.exe to enumerate local user accounts. These specific actions are intended to trigger the detection rule to validate if the SOC receives an alert.

• Regression Test Script:

  # Simulation Script for SafePay Detection Validation
  
  Write-Host "[+] Starting Simulation..." -ForegroundColor Cyan
  
  # 1. Simulate PowerShell 'ShareFinder.ps1' execution
  $scriptPath = Join-Path $env:TEMP "ShareFinder.ps1"
  "Write-Host 'Scanning for shares...'" | Out-File -FilePath $scriptPath -Encoding ascii
  Write-Host "[+] Executing ShareFinder.ps1..." -ForegroundColor Yellow
  Start-Process powershell.exe -ArgumentList "-File `"$scriptPath`"" -WindowStyle Hidden
  
  Start-Sleep -Seconds 2
  
  # 2. Simulate 'net user' via cmd.exe
  Write-Host "[+] Executing 'net user' via cmd.exe..." -ForegroundColor Yellow
  Start-Process cmd.exe -ArgumentList "/c net user" -WindowStyle Hidden
  
  Write-Host "[+] Simulation Commands Dispatched." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup Simulation Artifacts
  $scriptPath = Join-Path $env:TEMP "ShareFinder.ps1"
  if (Test-Path $scriptPath) {
      Remove-Item $scriptPath -Force
      Write-Host "[+] Cleanup: Removed $scriptPath" -ForegroundColor Green
  } else {
      Write-Host "[!] Cleanup: Script not found, nothing to remove." -ForegroundColor Gray
  }