CISA Details SafePay Ransomware TTPs

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

CISA, FBI and international partners detail SafePay ransomware's exploitation of VPN and edge-device flaws to hit 600+ organizations worldwide since 2024.

This joint advisory from CISA, FBI, USSS, and law enforcement in Germany and the UK details tactics, techniques, and indicators of compromise associated with SafePay ransomware, one of the most active ransomware operations observed through 2026. Since August 2024, SafePay has compromised at least 600 victims across North America, South America, Europe, and Australia, spanning multiple critical infrastructure sectors. The group gains initial access through credential exposure, brute-force attacks, and exploitation of VPN access—notably routing traffic through Mullvad VPN IP addresses—along with exploitation of known CVEs in edge devices and internet-exposed systems (including Cisco ASA, Fortinet FortiOS, and VMware/vCenter-related flaws).

Once inside a network, SafePay actors rely heavily on living-off-the-land techniques: PsExec, WinRM, and RDP for lateral movement; PowerShell scripts like ShareFinder.ps1 and tools like SharpShares.exe for share enumeration; UAC bypass and token impersonation for privilege escalation; and disabling of security software to evade detection. Data is staged and exfiltrated using legitimate tools such as FileZilla, 7-Zip, WinRAR, WinSCP, RClone, and occasionally OneDrive, with AnyDesk and TeamViewer used for remote access and payload delivery. Prior to encryption, actors disable Volume Shadow Copy Service and factory-reset NAS devices to inhibit recovery, then deploy a hybrid ChaCha20/RSA encryption scheme, appending the .SafePay extension to affected files. The group conducts double extortion, threatening to post stolen data on a leak site and using phone pressure campaigns if ransom (demanded in cryptocurrency) is not paid.

The advisory provides extensive MITRE ATT&CK mappings and mitigation guidance including MFA enforcement, patching of known exploited vulnerabilities, network segmentation, offline immutable backups, and restricting command-line/scripting capabilities. Limited specific IOCs are provided beyond generic Windows hostnames and the list of leveraged legitimate tools; organizations are urged to corroborate historical indicators with current telemetry given the dynamic nature of attacker infrastructure.

title: Volume Shadow Copy Deletion or VSS Service Disabling
description: Detects shadow copy deletion via vssadmin or wmic, and stopping or disabling
  the VSS service via sc.exe or net.exe. Ransomware such as SafePay does this before
  encryption to inhibit recovery.
tags:
- attack.impact
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_sc_disable:
    Image|endswith: \sc.exe
    CommandLine|contains|all:
    - config
    - vss
    - disabled
  selection_net_stop:
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains: stop vss
  condition: 1 of selection_*
falsepositives:
- Backup or storage maintenance scripts that purge shadow copies to reclaim disk space
- Administrators deliberately disabling VSS on build or lab servers
level: high
id: 3cc416f1-c71d-5b69-b722-193b2531dac5
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a

title: Rclone Execution with Data Transfer Arguments
description: Detects rclone launched with copy, sync, move or transfer-related arguments,
  including renamed binaries identified by OriginalFileName. SafePay actors use RClone
  to exfiltrate staged data to cloud or remote storage.
tags:
- attack.exfiltration
- attack.t1567
- attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith: \rclone.exe
  - OriginalFileName: rclone.exe
  selection_cli:
    CommandLine|contains:
    - ' copy '
    - ' sync '
    - ' move '
    - ' --transfers'
    - ' --ftp-host'
    - ' --sftp-host'
  condition: selection_img and selection_cli
falsepositives:
- Administrators using rclone for sanctioned backup or cloud sync jobs
- DevOps staff syncing build artefacts to object storage
level: high
id: d8840ca0-cb19-5ca0-84d4-63d00231a52d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a

title: PsExec Service Binary Executed on Host
description: Detects execution of PSEXESVC.exe, the service component PsExec installs
  on the remote target during lateral movement. SafePay actors use PsExec for lateral
  movement and payload execution.
tags:
- attack.lateral-movement
- attack.execution
- attack.t1569.002
- attack.t1021.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \PSEXESVC.exe
  condition: selection
falsepositives:
- Legitimate administrators using PsExec for remote management
- IT automation or patching tools that wrap PsExec
level: medium
id: a8b5009c-b1d9-5521-8b80-a981dcc8836b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a