Critical Infrastructure Security
,
Cybercrime
,
Fraud Management & Cybercrime
Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days
Tiffany Wang •
October 21, 2026
Since August 2024, SafePay has compromised at least 600 victims across multiple critical infrastructure sectors. (Image: Shutterstock)
A double-extortion group called SafePay has been actively targeting businesses and critical infrastructure worldwide, according to a joint cybersecurity advisory from U.S., U.K. and German government agencies.See Also: OnDemand | Beyond Point Solutions: Securing AI Coding, Models, and Runtime Environments
Since August 2024, SafePay has compromised at least 600 victims across multiple critical infrastructure sectors, the Cybersecurity and Infrastructure Security Agency said Tuesday. The financially motivated campaigns are characterized by data theft followed by swift encryption of victim systems within 24 hours.
The ransomware group posted 13 breaches in the first 12 days of October on its data leak site, with victims including a U.S. biotechnology firm to a Swiss hotel and a German construction company.
Despite the prolific attacks, SafePay maintains a low profile by operating independently throughout its ransomware campaigns. The group handles initial access, deployment and extortion in house rather than renting its malware to affiliates like most ransomware-as-a-service operators, said threat intelligence firm Huntress.
SafePay’s ransomware binary overlaps with the leaked LockBit Black source code, Huntress said, sharing command-line flags and encryption logic with the ransomware builder that has enabled numerous new variants since 2022.
“SafePay has added its own features on top, including a Cyrillic language kill switch that stops the malware from running on systems set to Eastern European languages,” Huntress said.
Many cybersecurity firms suspect SafePay is based in Russia. “The group does not allow targeting of Commonwealth of Independent States,” said U.K.-based Quorum Cyber. “This is commonly a trait of groups based within Russia.”
The group gains initial access through compromised credentials, brute-force password attacks and exploitation of VPN vulnerabilities, the Federal Bureau of Investigation, U.S. Secret Service and Germany’s Landeskriminalamt Rheinland-Pfalz reported.
SafePay actors route their connections through commercial VPN service Mullvad to conceal their actual IP addresses when accessing victim networks and rely on accounts stolen from phishing to authenticate.
To gain initial access, they exploit edge device flaws in Cisco security software Adaptive Security Appliance and Firepower Threat Defense that provide firewall and VPN services. One vulnerability, tracked as CVE-2020-3259, could allow attackers to retrieve sensitive information from an affected devices’ memory. The other flaw, assigned CVE-2023-20269, could allow unauthorized users to establish clientless SSL VPN sessions.
The agencies also found SafePay exploiting two vulnerabilities in data backup software Veeam. One flaw, tracked as CVE-2023-27532, could allow attackers to obtain encrypted credentials from the configuration database and gain access to backup infrastructure hosts. The other one, cataloged as CVE-2024-40711, is a high-severity deserialization vulnerability that could allow remote code execution.
Another vulnerability in firewall and VPN provider SonicWall, assigned CVE-2024-40766, is also used to gain unauthorized access.
“After SafePay threat actors gain access to a victim network, they establish persistence by gaining administrative privileges on existing accounts, or on newly created accounts, using built-in administrative tools consistent with living off the land techniques,” CISA said.
The group uses legitimate Windows administration tools, including PsExec and Windows Remote Management, to remotely execute commands.
In several instances, it used a PowerShell script function to enumerate shared folders and other network-accessible storage locations in Windows Active Directory environments to identify valuable assets for exfiltration.
The group also bypasses controls and abuses User Account Control mechanisms that allow privilege escalation to the administrator level to perform certain tasks.
SafePay then moves laterally within the network and identifies files for exfiltration and encryption. It compresses and collects data with legitimate tools, such as FileZilla, 7-Zip, RClone and WinRAR, and uses file transfer tools WinSCP and RClone – sometimes Microsoft’s OneDrive – to send data to actor-controlled accounts.
Following exfiltration, the group locks files with hybrid encryption, “combining a ChaCha20 stream cipher with an RSA public-key cryptosystem for a fast and secure key exchange,” CISA said. This approach helps SafePay customize encryption methodsbased on file type and size. A .safepay extension is appended to affected files.
The threat actor typically demands part of a company’s revenue in cryptocurrency. It leaves a ransom note on a victim’s desktop or root directory and makes a representative phone the company on behalf of the group to extort.
——————————————————–
Click Here For The Original Source.
