SafePay Ransomware Operations and TTPs

SafePay ransomware has emerged as a highly active threat group since August 2024, impacting over 600 organizations across North America, South America, Europe, and Australia. The group utilizes a combination of credential theft, brute force attacks, and exploitation of known vulnerabilities (including CVE-2024-40711 and CVE-2024-40766) to gain initial access to victim networks.

Technically, the group employs a "living off the land" strategy, leveraging legitimate tools like PsExec, WinRM, and RClone for lateral movement and data exfiltration. Their impact involves a sophisticated hybrid encryption scheme using ChaCha20 and RSA, followed by double extortion tactics where stolen data is published to a leak site if ransoms in cryptocurrency are not paid. They also actively inhibit recovery by resetting Network Attached Storage (NAS) and halting Volume Shadow Copy Services.

The group's targeting of critical infrastructure sectors and its high volume of activity in 2026 represent a significant risk to operational continuity. Organizations are urged to prioritize patching internet-facing vulnerabilities and implementing robust identity and access management controls to mitigate this threat.