Search — “SafePay”

A joint FBI/CISA/USSS/German/UK advisory details SafePay, a private ransomware group active since August 2024 with 600+ victims. Initial access comes via credential exposure, brute force, phished accounts over Mullvad VPN IPs, and exploitation of Cisco ASA/FTD, Veeam B&R and SonicWall SonicOS flaws. Post-compromise activity includes account creation and manipulation, PsExec/WinRM/RDP lateral movement, ShareFinder.ps1/SharpShares share enumeration, and disabling security tools. The actors then exfiltrate with RClone/WinSCP/b2.exe/OneDrive, stop VSS, factory-reset NAS backups and encrypt files to .SafePay. Hunt for VPN logins from Mullvad IPs, PsExec/WinRM use, share-enumeration tools, rclone/b2.exe executions and shadow copy service stops.