SafePay gets in with a password that works, not with novel malware, and it can go from that first VPN login to encrypted hypervisors in a day or two. The group surfaced in late 2024, became one of the most prolific names on ransomware leak sites through 2025, and in October 2026 was the subject of a joint #StopRansomware advisory from CISA, the FBI, the US Secret Service and UK and German law enforcement partners. Unlike most leading ransomware brands it runs as a closed team with no affiliate programme, which makes its behaviour more consistent than a ransomware-as-a-service brand and easier to defend against once you know the pattern. This profile covers who SafePay is, who it targets, the techniques reported by government partners and incident responders mapped to MITRE ATT&CK, its reliance on valid credentials, and the detections and controls that break its intrusions. It is for SOC analysts, incident responders and remote access owners, and goes deeper on one group than the Ransomware Groups Guide.
Key takeaways
- A closed group, not a platform. SafePay states on its leak site that it does not offer ransomware-as-a-service, and Bitdefender and Triskele Labs both describe it as operating without affiliates, so its tradecraft is relatively uniform across victims.
- Remote access credentials are the front door. The joint advisory and every responder report reviewed here describe initial access through exposed or brute-forced credentials on VPNs and other edge services, often where MFA was missing or bypassable.
- Speed leaves little time to react. Bitdefender reports intrusions moving from initial access to encryption in 24 hours or less, and NCC Group documented deployment two days after a VPN login.
- Backups and hypervisors are deliberate targets. Operators delete shadow copies, stop backup services, reset network attached storage holding backups and encrypt hypervisors, according to the advisory and responder reports.
- Detection opportunities are behavioural. Defender tampering, regsvr32 loading a DLL from an odd path, recursive WinRAR archiving, a short-lived FileZilla install and VPN logins from anonymising VPN or VPS ranges all appear before encryption.
Who they are (names and aliases)
SafePay is a financially motivated data theft and encryption operation. The CISA bulletin announcing advisory AA26-293A (20 October 2026) says SafePay has affected at least 600 organisations across multiple critical infrastructure sectors since August 2024, in North America, South America, Europe and Australia. Bitdefender traced the group's origins to September 2024 and its data leak site to November 2024; Triskele Labs gives a first-seen date of October 2024.
No widely used alias exists; the operators call themselves the "SafePay team" in ransom notes, according to Barracuda. MITRE ATT&CK had no group or software entry for SafePay when this page was checked in November 2026, so the technique mapping below comes from the advisory bulletin and named incident response reports rather than an ATT&CK group page.
Code lineage: Bitdefender and Barracuda report overlap with the leaked LockBit Black (LockBit 3.0) code base, and Triskele Labs says the ransomware is built on leaked LockBit source. Bitdefender assesses that SafePay operates independently of LockBit. Leaked builders are reused by many unrelated groups, so shared code is not evidence of shared people. See the Ransomware Family Lineage and Rebrands Guide and the LockBit Threat Actor Profile.
| Date | Milestone | Source |
|---|---|---|
| August to October 2024 | First observed activity (dates vary by observer) | CISA bulletin, Bitdefender, Triskele Labs |
| November 2024 | Data leak site appears; 23 victims posted on 20 November | Bitdefender |
| 30 March 2025 | Peak single-day posting of 29 victims | Bitdefender |
| June 2025 | 73 claimed victims, top of Bitdefender's monthly ranking | Bitdefender |
| July 2025 | Claimed attack on a global technology distributor that disrupted ordering for several days | Barracuda |
| 20 October 2026 | Joint #StopRansomware advisory AA26-293A, covering activity observed from November 2024 to August 2026 | CISA bulletin, BleepingComputer |
Targeting and motivation
SafePay's motive is money: Barracuda notes the ransom note states the group wants "nothing more than money", and the model is double extortion, stealing data first and threatening publication if the victim does not pay. The CISA bulletin adds that operators have in some cases phoned victims directly to raise the pressure. Bitdefender reports victims are given 10 days to make contact before data is leaked.
- Size: Bitdefender describes mid-size and enterprise organisations, with median victim revenue around 5 million US dollars and occasional much larger targets, including organisations with extensive partner and client networks.
- Sectors: manufacturing, healthcare, construction, education and research, government and technology, including IT service providers (Bitdefender); Triskele Labs adds civil engineering and food supply chain businesses and says no industry appears out of scope.
- Geography: most claimed victims are in the United States, Germany, the United Kingdom and Canada (Bitdefender), with Australian incidents documented by Triskele Labs.
Tactics and techniques (MITRE ATT&CK)
The table maps behaviour reported in the CISA bulletin and by NCC Group, Huntress, Triskele Labs, Bitdefender and Barracuda to ATT&CK v20 techniques. It is a defender's reference for hunting and control coverage.
| Tactic | Technique | Reported behaviour | Source |
|---|---|---|---|
| Initial access | T1133 External Remote Services; T1078.002 Domain Accounts | VPN and Remote Desktop Gateway logins with valid or exposed credentials | CISA bulletin, Triskele Labs, Huntress |
| Credential access | T1110 Brute Force | Password guessing against internet-facing logins | CISA bulletin, Bitdefender |
| Initial access | T1667 Email Bombing; T1566.004 Spearphishing Voice; T1219 Remote Access Tools | Inbox flood followed by fake IT support call or Teams message offering a Quick Assist session | Barracuda |
| Privilege escalation | T1548.002 Bypass User Account Control | UAC bypass through the CMSTPLUA COM interface, DllHost.exe as parent | Huntress, NCC Group |
| Persistence | T1543.003 Windows Service | ScreenConnect installed as an auto-start service | NCC Group |
| Discovery | T1135 Network Share Discovery | ShareFinder PowerShell script used to map shares that feed the encryption step | Huntress, Bitdefender |
| Lateral movement | T1021.001 RDP; T1021.002 SMB/Windows Admin Shares; T1569.002 Service Execution | RDP sessions, PsExec, payload copied over admin shares | NCC Group, Bitdefender, Barracuda |
| Defence impairment | T1685 Disable or Modify Tools | Defender settings changed, anti-malware processes and security services stopped | Huntress, Bitdefender |
| Stealth | T1218.010 Regsvr32; T1027.002 Software Packing; T1070.004 File Deletion | Ransomware DLL loaded by regsvr32, UPX-packed backdoor, artefact deletion | Huntress, NCC Group, Triskele Labs |
| Collection | T1560.001 Archive via Utility; T1074.001 Local Data Staging | WinRAR or 7-Zip archives of user directories, split into volumes | Huntress, Triskele Labs |
| Exfiltration | T1048 Exfiltration Over Alternative Protocol; T1567.002 Exfiltration to Cloud Storage | FileZilla FTP transfers, Rclone, or bulk transfer back over the VPN tunnel | Huntress, Triskele Labs |
| Impact | T1490 Inhibit System Recovery; T1486 Data Encrypted for Impact; T1531 Account Access Removal | Shadow copies deleted, boot recovery disabled, NAS backups reset, files encrypted with ChaCha20, admin passwords changed | CISA bulletin, NCC Group, Huntress |
Encryptor traits worth knowing for triage: encrypted files carry the .safepay extension and the ransom note is readme_safepay.txt (NCC Group, Bitdefender, Huntress). The encryptor checks the system language and exits on several Cyrillic-script locales (T1614.001 System Language Discovery), stops processes and services linked to databases, Exchange, Veeam and other backup tools, and can target UNC paths and network drives. NCC Group found it uses partial encryption of large files, so recovery tools that claim to restore "intermittently encrypted" files should be treated with caution and tested on copies.
How they abuse identities and credentials
Identity is the whole SafePay playbook.
- MFA gaps on VPN policy: NCC Group investigated a case where a FortiGate firewall policy allowed local and LDAP groups to authenticate to the VPN without MFA. The attacker used a local account with a weak password, then a domain administrator account that MFA did not cover. Audit every VPN authentication path, not just the main one.
- Remote Desktop Gateway: Triskele Labs notes RD Gateway does not enforce MFA natively and needs an additional component; unprotected gateways are a recurring entry point.
- Credential sources: credentials come from phishing, initial access brokers and public dumps (Triskele Labs), plus brute force (CISA bulletin). Password reuse between personal and corporate accounts turns an old dump into a live login.
- Anonymised origin: the CISA bulletin highlights VPN access from IP addresses associated with the Mullvad VPN service; Triskele Labs also observed Proton VPN, and NCC Group saw an admin account logging in from a host named "vultr-guest", linked to Vultr VPS infrastructure.
- Help desk and support impersonation: Barracuda describes email bombing followed by a fake IT support contact asking the user to start Quick Assist. See the Email Bombing and Help Desk Impersonation over Teams Guide.
- Lock-out of defenders: NCC Group reports the attacker changed all admin passwords, which slowed the response. Keep break-glass accounts outside the domain and outside the VPN identity store.
- Machine and backup identities: service accounts used by backup servers and NAS devices let operators reach and wipe recovery copies. Barracuda's summary lists Veeam Backup and Replication vulnerabilities (CVE-2023-27532, CVE-2024-40711) alongside edge device flaws (CVE-2020-3259, CVE-2023-20269 in Cisco ASA and FTD, CVE-2024-40766 in SonicWall SonicOS); all five are in CISA's Known Exploited Vulnerabilities catalogue marked as known ransomware use. Give backup infrastructure its own non-domain identities, as covered in the Recovering IAM and PAM After Ransomware or Domain Compromise guide.
Notable incidents
Most SafePay victims are known only from leak site claims, which are unverified and exclude victims who paid. The cases below are those documented by government partners or by named responders.
| Case | What was reported | Lesson |
|---|---|---|
| Joint advisory AA26-293A (October 2026) | At least 600 organisations affected since August 2024 across critical infrastructure sectors; brute force, exposed credentials, Mullvad-associated VPN access, edge device CVEs, shadow copy deletion and NAS backup resets | Treat VPN and edge authentication as a critical control; protect backup storage administration |
| NCC Group incident response (published March 2025) | VPN MFA bypass through local and LDAP groups, domain admin without MFA, ScreenConnect persistence, a backdoor loaded via regsvr32, ransomware deployed at T+2 days, hypervisors encrypted | Every VPN auth path and every privileged account needs MFA |
| Huntress incidents (October 2024) | Valid credentials over VPN, RDP, Defender settings changed through the GUI, WinRAR and FileZilla exfiltration repeated over two days, then encryption of network shares | Exfiltration often runs a day ahead of encryption, which is the window to catch it |
| Triskele Labs Australian incidents (2025 to 2026) | VPN entry, RDP clipboard staging, data sent over the VPN tunnel itself without a separate transfer tool | Watch outbound volume on VPN sessions, not just internet egress |
| Global technology distributor (July 2025) | SafePay claimed an attack that disrupted ordering systems for several days; the company did not publicly attribute it, and breach notices reported personal data of 42,521 people taken (Barracuda) | Claims and confirmed attribution differ; plan communications for both |
If your organisation appears on the leak site, follow the Ransomware Data Leak Site Listing Playbook.
Detection and defence
Detections drawn from the reported behaviour:
| Signal | Telemetry | Why it matters |
|---|---|---|
| VPN or RD Gateway login from anonymising VPN or VPS ranges, or brute force followed by success | VPN and firewall authentication logs, identity provider sign-in logs | The initial access step in the advisory and most responder reports |
| Defender configuration change or tamper events | Microsoft Defender events 5001 (real-time protection disabled) and 5007 (configuration changed), plus 1119 failures (Huntress) | Precedes deployment in reported cases |
| DllHost.exe with CMSTPLUA spawning scripts or unsigned binaries | EDR process creation | UAC bypass reported by Huntress and NCC Group |
| regsvr32.exe loading a DLL from ProgramData, user folders or a UNC share | EDR, Sysmon process and image load events | How the ransomware and a backdoor were loaded |
| WinRAR or 7-Zip with recursive or volume-split switches across user directories | EDR command line | Staging before exfiltration |
| FileZilla, Rclone or a new RMM tool installed and removed within hours | EDR software inventory, outbound FTP and cloud storage traffic | Exfiltration and persistence tools |
| vssadmin or wmic shadow copy deletion, bcdedit recovery changes, NAS configuration reset | EDR, NAS audit logs | Last chance before encryption |
Controls in priority order:
- Close every non-MFA path into remote access. Review each VPN portal, group policy, local account and LDAP fallback, and RD Gateway. Require phishing-resistant MFA for administrators. The Securing the ZTNA broker and remote access VPN itself guide covers hardening.
- Patch edge devices and backup servers from the KEV catalogue first. Prioritise the five CVEs listed above where the products are present. See the Edge Device Security Guide.
- Stop brute force. Rate limiting, lockout thresholds and alerts on spray patterns; see the Account Lockout and Brute-Force Protection Guide.
- Constrain admin tools. The CISA bulletin recommends limiting administrative tools and privileges to users who need them: restrict PsExec, RDP and WinRM to admin workstations, and allowlist approved RMM tools.
- Separate and harden backups. Separate backup administration identities from the domain, keep immutable or offline copies and test full restores; see the Backup Security and Immutable Backup Guide.
- Deploy EDR everywhere. Triskele Labs observed attackers using hosts without security tooling as staging points; turn on tamper protection.
- Train for the support scam. An inbox flood followed by an offer of help is a known pattern: users should verify through a separate channel.
- Prepare to respond out of hours. Responders note activity often happens outside business hours; confirm 24x7 alert coverage and a tested isolation runbook.
Metrics that show the defences are working: percentage of VPN and RD Gateway authentication paths enforcing MFA (target 100%); privileged accounts without MFA (target zero); median days to patch KEV-listed edge and backup vulnerabilities; percentage of servers and hypervisor hosts with EDR and tamper protection; successful full restore tests per quarter from immutable copies; mean time to alert on Defender tamper events.
Framework mapping
| Defence | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| MFA on remote and privileged access | PR.AA-03 | IA-2(1), AC-17 |
| Least privilege for admin tools | PR.AA-05 | AC-6 |
| Brute force protection | PR.AA-03 | AC-7 |
| Network and endpoint monitoring | DE.CM-01 | SI-4 |
| Protected, tested backups | PR.DS-11, RC.RP-03 | CP-9 |
Practitioner checklist
- Enumerate every VPN, firewall portal and RD Gateway authentication path and confirm MFA on each, including local and LDAP fallbacks.
- Find and remove MFA exclusions for domain administrator and service accounts.
- Alert on remote access logins from anonymising VPN and VPS address ranges.
- Patch CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 where the products exist.
- Restrict PsExec, RDP and WinRM to administrative workstations; allowlist RMM tools.
- Detect Defender events 5001 and 5007, regsvr32 loading DLLs from unusual paths, and recursive archiving.
- Give backup servers and NAS devices non-domain admin identities, MFA and immutable copies; test a full restore.
- Keep break-glass accounts outside the domain and VPN identity store.
- Brief users on email bombing followed by fake IT support calls.
Standards and references
- CISA: CISA, FBI and Partners Release Joint Cybersecurity Advisory on SafePay Ransomware
- CISA: Known Exploited Vulnerabilities Catalog
- NCC Group: Weak passwords led to SafePay ransomware yet again
- Huntress: It's not safe to pay SafePay
- Bitdefender: SafePay ransomware, how a non-RaaS group executes rapid fire attacks
- Triskele Labs: SafePay ransomware targeting Australian organisations
- Barracuda: SafePay, email bombs, phone scams and really big ransoms
Related NHI Mgmt Group resources: Ransomware Groups Guide · Edge Device Exploitation by Threat Actors Guide · Password Spraying and Credential Stuffing Defence Guide · Ransomware-as-a-Service Business Model Guide · ATT&CK Ransomware Software Hub