Source: cisa.gov
CISA, FBI, USSS, and international partners issued a joint advisory on SafePay ransomware, active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors gain initial access via credential theft, brute force, phishing, and exploitation of known CVEs in VPN and edge devices. After gaining access, they establish persistence using LOTL techniques, escalate privileges via UAC bypass, move laterally with RDP/WinRM/PsExec, and exfiltrate data using tools like RClone, FileZilla, and WinSCP. Files are encrypted using a hybrid ChaCha20 and RSA encryption scheme, appended with '.SafePay', and ransom is demanded in cryptocurrency. The group has impacted at least 600 victims and operates a leak site on TOR for double-extortion. Key mitigations include patching known exploited vulnerabilities, implementing MFA, network segmentation, offline backups, and Zero Trust principles.
