#StopRansomware: SafePay Ransomware

This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics.

Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection. Following, they encrypt the victim’s files, making them inaccessible, and leave a ransom note demanding payment in cryptocurrency. This advisory urges organizations to follow recommended security measures to reduce the risk and impact of SafePay ransomware attacks.

CVE-2020-3259 [ Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor ]

CVE-2023-20269 [ CWE-288: Authentication Bypass Using an Alternate Path or Channel ]

CVE-2023-27532 [ CWE-306: Missing Authentication for Critical Function ]

CVE-2024-40711 [ CWE-502: Deserialization of Untrusted Data ]

CVE-2024-40766 [ CWE-284: Improper Access Control ]

Regularly patch and update systems, especially firewalls, and other edge devices.

Implement Zero Trust Principle.

Restrict administrative tools and privileges to necessary users only.

Strengthen account security by implementing identity, credential, and access management (ICAM) policies and multifactor authentication (MFA).

For a downloadable copy of indicators of compromise, see:

AA26-293A STIX XML (40 KB)

AA26-293A STIX JSON (38 KB)

Organizations: Government; Federal Civilian Executive Branch (FCEB); State, Local, Tribal, and Territorial (SLTT); Critical Infrastructure

Roles: Defensive cybersecurity analysts , vulnerability analysts , security systems managers , and operational technology (OT) owners and operators

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), United States Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency, and the United Kingdom’s North West Regional Organised Crime Unit—hereafter referred to as the authoring agencies—are releasing this joint advisory to disseminate known SafePay ransomware TTPs and IOCs identified through FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations as recently as August 2026.

Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.

The authoring agencies encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents.

Download the PDF version of this report:

For a downloadable copy of IOCs, see:

Note: This advisory uses the MITRE ATT&CK ® Matrix for Enterprise framework, version 20. See MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [ TA0001 ] to organizations through various means, including credential exposure, implementing brute force password attacks [ T1110 ], and exploiting virtual private network (VPN) access. SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products:

CVE-2020-3259 [ Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor ]

CVE-2023-20269 [ CWE-288: Authentication Bypass Using an Alternate Path or Channel ]

Additionally, the authoring agencies observed SafePay threat actors exploiting the following vulnerabilities across internet-exposed systems [ T1190 ] for initial access through automated scripts:

CVE-2023-27532 [ CWE-306: Missing Authentication for Critical Function ]

CVE-2024-40711 [ CWE-502: Deserialization of Untrusted Data ]

CVE-2024-40766 [ CWE-284: Improper Access Control ]

Execution, Persistence, Stealth, and Defense Impairment

After SafePay threat actors gain access to a victim network, they establish persistence by gaining administrative privileges on existing accounts [ T1098 ], or on newly created accounts [ T1136 ], using built-in administrative tools consistent with living off the land (LOTL) techniques. Once SafePay threat actors establish a foothold in a victim’s network, they use LOTL binaries (LOLBins) [ T1218 ], such as PsExec [ T1021.002 ] and Windows Remote Management (WinRM) [ T1021.006 ], to execute commands on remote systems. In several instances, SafePay threat actors used ShareFinder.ps1 —a PowerShell script function used for enumerating network file shares in Windows Active Directory environments—to identify valuable assets for exfiltration [ T1059.001 , T1059.003 ]. Additionally, SafePay threat actors used SharpShares.exe , a tool used to identify and enumerate network file shares.

As SafePay threat actors prepare for lateral movement, they commonly disable security software [ T1685 ] to avoid detection. In some cases, the threat actors changed the passwords of system users, making valid logins impossible. SafePay threat actors have also been observed using software packing or virtual machine software protection to conceal their code [ T1027.002 ].

The authoring agencies observed SafePay threat actors using a User Account Control (UAC) Bypass Privilege Escalation technique [ T1548.002 ] that creates an elevated process through a specified component object model, enabling the execution of malicious commands or binaries [ T1059 ]. SafePay threat actors have also been observed using token impersonation methods [ T1134.001 ].

To pivot laterally through a network and identify files for exfiltration [ TA0010 ] and encryption, SafePay threat actors use legitimate tools like PsExec, WinRM, and Remote Management and Monitoring [ T1569.002 ] software. They also employ Remote Desktop Protocol (RDP) [ T1021.001 , T1133 ] to expand their presence within the compromised network [ T1021 ]. As SafePay threat actors move laterally through a network, they look for credentials to gain admin access and will create accounts, if needed.

Collection, Exfiltration, and Impact

SafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [ T1560.001 ], and WinSCP and RClone to facilitate the exfiltration of data [ T1048 ] from the compromised network to actor-controlled accounts. In some instances, SafePay threat actors use OneDrive to exfiltrate data [ T1567 ]. In other instances, the SafePay threat actors installed legitimate remote desktop tools like AnyDesk or TeamViewer on the victim’s systems. SafePay threat actors use these tools to transfer ransomware and other software onto a victim’s system. Additionally, SafePay threat actors halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts [ T1490 ].

Following exfiltration, SafePay threat actors encrypt files [ T1486 ] using a sophisticated hybrid encryption scheme to lock data. This involves combining a ChaCha20 stream cipher with an RSA public-key cryptosystem for a fast and secure key exchange. This multilayered approach customizes encryption methods based on file type and size and enables full or partial encryption. Data encrypted with the SafePay ransomware variant (appended with .SafePay ) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software. SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. To put pressure on the victim, a representative makes phone calls on behalf of the ransomware group. If the victim does not pay, SafePay posts the exfiltrated data to their SafePay leak website, which is linked in the ransom note. Following encryption, SafePay may delete itself from the victim’s filesystem [ T1070.004 ].

Table 1 lists publicly available tools and applications used by SafePay threat actors, including legitimate tools repurposed for their operations. Note: These tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.

Indicators of Compromise

Table 2 through Table 5 list IOCs associated with SafePay ransomware that allowed for the identification of malicious activity. Disclaimer: The authoring agencies recommend organizations investigate or verify IP addresses prior to taking action, such as blocking. These IOCs were observed between November 2024 and August 2026.

Note: Some of these files are legitimate tools. The authoring organizations recommend organizations investigate or verify tool use prior to taking action, such as blocking.

The following are IOC hostnames:

MITRE ATT&CK Tactics and Techniques

See Table 6 through Table 16 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool .

If a potential compromise is detected, but ransomware actors have not (yet) encrypted items, organizations should take the following actions:

Determine which hosts were compromised and isolate them by quarantining or taking them offline.

Initiate threat hunting activities to scope the intrusion . Collect and review relevant artifacts, logs, and other data to identify threat actor TTPs, compromised devices and accounts, a timeline of activity, etc.

Report the suspected compromise to the FBI and other agencies as appropriate (if located within the U.K., report the compromise to Report Fraud or local police force ) (see the Reporting section for information).

Apply eviction countermeasures , including those listed below, to contain the incident and eradicate the threat actor from the network ( Note: Start applying countermeasures after collecting enough threat hunting data to inform effective countermeasure selection; this will likely overlap with threat hunting activities). Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan—the tool comprises Playbook-NG (a web application) and COUN7ER (a database of post-compromise countermeasures mapped to adversary TTPs). Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool fact sheet.

Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan—the tool comprises Playbook-NG (a web application) and COUN7ER (a database of post-compromise countermeasures mapped to adversary TTPs). Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool fact sheet.

Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool fact sheet.

Harden the network to prevent additional malicious activity (see Mitigations for guidance).

If compromise is detected and items have been encrypted, see the “Ransomware and Data Extortion Response Checklist” in CISA’s joint #StopRansomware Guide .

The authoring agencies recommend organizations implement the mitigations below to improve their cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

Organizations should implement the following mitigations:

Prioritize remediating known exploited vulnerabilities (KEVs) and keep all operating systems, software, and firmware up to date , as timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats; specifically, prioritize patching KEVs in internet-facing systems. [ CPG 2.B ]. Additionally, using Binding Operational Directive 26-04 offers a framework for patch prioritization based on technology type and steps for forensics triage. Under its implementation guidance, it offers guidance and steps to perform forensic triage for severe vulnerability cases.

Additionally, using Binding Operational Directive 26-04 offers a framework for patch prioritization based on technology type and steps for forensics triage. Under its implementation guidance, it offers guidance and steps to perform forensic triage for severe vulnerability cases.

Implement identity, credential, and access management (ICAM) policies across the organization and require MFA for all services to the greatest extent possible—particularly for webmail, VPNs, and accounts that access critical systems [ CPG 3.F ].

Require all accounts with password logins (e.g., service accounts, admin accounts, and domain admin accounts) to comply with NIST’s digital identity guidelines ; require employees to use long passwords and consider not requiring recurring password changes, as these can weaken security [ CPG 3.B ]. Use longer passwords consisting of at least 15 characters and no more than 64 characters in length. Store passwords in a hashed format using industry-recognized password managers. Add password user “salts” to shared login credentials. Avoid reusing passwords [ CPG 3.C ]. Implement multiple failed login attempt account lockouts [ CPG 3.E ]. Disable password “hints.” Refrain from requiring password changes more frequently than once per year. Note: NIST guidance suggests favoring longer passwords instead of requiring frequent password resets. Frequent password resets are more likely to result in users developing password patterns cyber threat actors can easily decipher.

Use longer passwords consisting of at least 15 characters and no more than 64 characters in length.

Store passwords in a hashed format using industry-recognized password managers.

Add password user “salts” to shared login credentials.

Avoid reusing passwords [ CPG 3.C ].

Implement multiple failed login attempt account lockouts [ CPG 3.E ].

Disable password “hints.”

Refrain from requiring password changes more frequently than once per year. Note: NIST guidance suggests favoring longer passwords instead of requiring frequent password resets. Frequent password resets are more likely to result in users developing password patterns cyber threat actors can easily decipher.

Maintain offline backups of data and regularly test and maintain backup and restoration processes [ CPG 3.O ]; implementing this practice helps organizations avoid severe operational interruptions and prevents scenarios in which data is irretrievable.

Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [ CPG 3.K ].

Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drives, storage devices, or the cloud) [ CPG 3.I , 3.O , 1.C ].

Segment networks to prevent the spread of ransomware, as network segmentation can help control traffic flows between, and access to, various subnetworks and restrict adversary lateral movement [ CPG 3.I ].

Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a network monitoring tool [ CPG 4.B ]. To aid in detecting ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. Endpoint Detection and Response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.

To aid in detecting ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network.

Endpoint Detection and Response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.

Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems—this prevents threat actors from directly connecting to remote access services that they have established for persistence.

Review domain controllers, servers, workstations, and Active Directories for new, unactive and/or unrecognized accounts.

Disable unused ports .

Consider adding an email banner to emails received from outside of your organization.

Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [ CPG 3.G ].

Implement time-based access for accounts set at the admin level and higher ; for example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust Maturity Model ). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.

This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need.

Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.

Disable command-line and scripting activities and permissions, since privilege escalation and lateral movement often depend on software utilities running from the command line; if threat actors cannot run these tools, they will have difficulty escalating privileges and moving laterally [ CPG 3.M ].

These mitigations align with principles provided in the joint guide Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software . CISA urges software manufacturers to take ownership of improving the security outcomes of their customers by applying these and other secure by design tactics. By implementing secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to make additional configuration changes, purchasing product security add-in software and logs, monitoring, and making frequent security updates.

Validate Security Controls

In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.

Select an ATT&CK technique described in this advisory (see Table 6 to Table 16 ).

Align your security technologies against the technique.

Test your technologies against the technique.

Analyze your detection and prevention technologies’ performance.

Repeat the process for all security technologies to obtain a set of comprehensive performance data.

Tune your security program, including people, processes, and technologies, based on the data generated by this process.

The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Stopransomware.gov is a whole-of-government approach that provides one central location for ransomware resources and alerts.

CISA’s #StopRansomware Guide provides organizations with comprehensive best practices to mitigate the risk of ransomware attacks.

CISA’s Known Exploited Vulnerabilities Catalog is an authoritative resource for organizations to support improvement of their patch management best practices.

CISA’s Multifactor Authentication webpage provides best practices for network defenders to mitigate threats to accounts and systems that use MFA.

CISA’s Cyber Hygiene Services help organizations reduce the risk of a successful cyberattack.

USSS’s Preparing for a Cyber Incident outlines basic steps an organization can take before, during, and after a cyber incident.

CISA’s Cyber Security Evaluation Tool (CSET) provides a systematic, disciplined, and repeatable approach for evaluating an organization’s security posture; see Downloading and Installing CSET for step-by-step guidance to help your organization evaluate cybersecurity practices on your networks.

CISA’s Ransomware Risk Assessment helps assess an organization’s ability to counteract a ransomware infection.

Department of Health and Human Services’ Cybersecurity Performance Goals is a resource to help healthcare organizations implement high-impact cybersecurity practices.

CISA’s Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk and its implementation guidance

CISA’s CI Fortify: Strengthening Resilience Across Critical Infrastructure

CISA’s Eviction Strategies Tool enables incident response teams to quickly turn observed behaviors into remediation plans

U.K.’s National Cyber Security Centre

U.K.’s National Crime Agency

Your organization has no obligation to respond or provide information to the FBI and other authoring agencies in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI or other authoring agencies, reporting must be consistent with applicable state and federal laws.

The FBI and other authoring agencies are interested in any information, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.

Additional details of interest include a targeted company point of , status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.

The authoring agencies do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI’s Internet Crime Complaint Center (IC3) , a local FBI field office , a local USSS Field Office , or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center ( @cisa.dhs.gov ) or by calling 1-844-Say-CISA (1-844-729-2472).

In the U.K., report incidents of a cybercrime or fraud at the UK’s for Reporting Cyber Crime & Fraud or 0300-123-2040, your local police force , or use the non-emergency number 101.

The information in this report is being provided “as is” for informational purposes only. CISA and the FBI/USSS do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, or USSS.

The authoring agencies recognize that infrastructure used for malicious activity may be hosted on cloud or virtualized platforms where IP addresses can be dynamically or temporarily assigned. As a result, an address associated with malicious activity at one point in time may later be reassigned to benign services. Accordingly, these indicators should be interpreted as historically observed infrastructure within the activity window and should be corroborated with current network telemetry or additional intelligence sources when used for defensive or investigative purposes.

October 20, 2026 : Initial version.

This product is provided subject to this Notification and this Privacy & Use policy.