Search — “CVE-2023-27532”

A joint FBI/CISA/USSS/German/UK advisory details SafePay, a private ransomware group active since August 2024 with 600+ victims. Initial access comes via credential exposure, brute force, phished accounts over Mullvad VPN IPs, and exploitation of Cisco ASA/FTD, Veeam B&R and SonicWall SonicOS flaws. Post-compromise activity includes account creation and manipulation, PsExec/WinRM/RDP lateral movement, ShareFinder.ps1/SharpShares share enumeration, and disabling security tools. The actors then exfiltrate with RClone/WinSCP/b2.exe/OneDrive, stop VSS, factory-reset NAS backups and encrypt files to .SafePay. Hunt for VPN logins from Mullvad IPs, PsExec/WinRM use, share-enumeration tools, rclone/b2.exe executions and shadow copy service stops.

Unit 42 reports that ransomware operators, including Qilin (Spikey Scorpius), Inc (Tarnished Scorpius) and Settra-linked actors, are exploiting the KEV-listed GlobalProtect portal/gateway authentication bypass CVE-2026-0257. They bypass MFA to establish VPN sessions, run reconnaissance with RMM tools, move laterally over RDP/SMB, and pivot to vCenter/ESXi. On ESXi they disable execInstalledOnly and dump credentials offline from a domain controller VMDK. Some actors chain the access with the Veeam exploit CVE-2023-27532. Hunters should check GlobalProtect logs for gateway-connected events from the listed IPs, the fake host IDs/MACs and the PoC client values. They should also look for VPN-to-vCenter access and ESXi security-setting changes.