FBI and CISA detail SafePay ransomware, which has hit at least 600 victims
The FBI, CISA, the Secret Service and police agencies in Germany and the UK say SafePay ransomware has hit at least 600 victims since August 2024. Its operators get in with stolen or guessed passwords, phishing and five known flaws in Cisco firewalls, Veeam Backup & Replication and SonicWall SonicOS. Their Oct 20 advisory lists the group’s tools and techniques, with indicators seen from November 2024 to August 2026.
- Versions
- Not applicable: the advisory covers a ransomware group. The five flaws it exploits have been in KEV since 2023 or 2024.
- CVE
- Vendors
- Cisco, Veeam, SonicWall
- Published
- Editor
- Austin Simas
Details
The agencies say SafePay’s operators use Mullvad VPN addresses and phished accounts to exploit two Cisco ASA and FTD flaws, and . They also run automated scripts against two Veeam Backup & Replication flaws, and , and SonicWall’s . All five have been in KEV since 2023 or 2024.
Once inside, the operators take over existing accounts or create new ones, run commands with PsExec and WinRM, and find file shares with ShareFinder.ps1 and SharpShares. They turn off security software, sometimes change users’ passwords, and bypass User Account Control. They steal data with tools including RClone, WinSCP and Backblaze’s b2.exe, and sometimes OneDrive.
They stop the Volume Shadow Copy Service and reset network-attached storage that holds backups to factory settings. Encrypted files get a .SafePay extension. The group calls victims to pressure them and posts stolen data on its leak site if they don’t pay.
The agencies say to verify the IP addresses before blocking them, since addresses can be reassigned to legitimate services. Four of the nine belong to GitHub, Cloudflare and Google, per registry records and the companies’ published address ranges, so blocking them could cut off widely used services.
What to do
7 steps
- 1 Patch Cisco ASA and FTD for CVE-2020-3259 and CVE-2023-20269, Veeam Backup & Replication for CVE-2023-27532 and CVE-2024-40711, and SonicOS for CVE-2024-40766.
Indicators
IPs copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| IP address | Victim intrusion, per the agencies, but a Cloudflare address, so low fidelity | |
| IP address | Victim intrusion, per the agencies, but registered to GitHub, so low fidelity | |
| IP address | Victim intrusion, per the agencies, but registered to GitHub, so low fidelity | |
| IP address | Victim intrusion, per the agencies | |
| IP address | Hosted victim data, per the agencies, but a Google address, so low fidelity | |
| IP address | Client login panels, per the agencies | |
| IP address | Used in exfiltration, per the agencies | |
| IP address | Command and control for soc.dll, per the agencies | |
| IP address | Used in exfiltration, per the agencies | |
| SHA-1 | 1.exe, the ransomware binary | |
| SHA-1 | Locker.dll | |
| SHA-1 | locker.dll | |
| SHA-1 | nxc, the NetExec network assessment tool | |
| SHA-256 | soc.dll | |
| SHA-256 | RunPE bundled DLL | |
| SHA-256 | Injected PE file | |
| SHA-256 | locker.dll | |
| SHA-256 | locker.dll | |
| SHA-256 | SharpShares.exe, a share enumeration tool | |
| File name | Suspected malicious executable, per the agencies | |
| File name | Likely ransomware or encryption component, per the agencies | |
| File name | Tool to extract Active Directory credentials | |
| File name | Likely masquerading as a Windows process, per the agencies | |
| File name | SOCKS proxy tool for tunneling traffic | |
| File name | Archive likely used to stage scanning tools |
- IP addressVictim intrusion, per the agencies, but a Cloudflare address, so low fidelity
- IP addressVictim intrusion, per the agencies, but registered to GitHub, so low fidelity
- IP addressVictim intrusion, per the agencies, but registered to GitHub, so low fidelity
- IP addressVictim intrusion, per the agencies
- IP addressHosted victim data, per the agencies, but a Google address, so low fidelity
- IP addressClient login panels, per the agencies
- IP addressUsed in exfiltration, per the agencies
- IP addressCommand and control for soc.dll, per the agencies
- IP addressUsed in exfiltration, per the agencies
- SHA-11.exe, the ransomware binary
- SHA-1Locker.dll
- SHA-1locker.dll
- SHA-1nxc, the NetExec network assessment tool
- SHA-256soc.dll
- SHA-256RunPE bundled DLL
- SHA-256Injected PE file
- SHA-256locker.dll
- SHA-256locker.dll
- SHA-256SharpShares.exe, a share enumeration tool
- File nameSuspected malicious executable, per the agencies
- File nameLikely ransomware or encryption component, per the agencies
- File nameTool to extract Active Directory credentials
- File nameLikely masquerading as a Windows process, per the agencies
- File nameSOCKS proxy tool for tunneling traffic
- File nameArchive likely used to stage scanning tools
Sources
- CISA joint advisory AA26-293APrimary source cisa.gov
- CISA KEV catalogPrimary source cisa.gov
- ARIN registration for GitHub’s networkPrimary source rdap.arin.net
- RIPE registration for GitHub’s networkPrimary source rdap.db.ripe.net
- Cloudflare IP rangesPrimary source cloudflare.com
- Google IP rangesPrimary source gstatic.com