(TLP:CLEAR) FBI, CISA, and International Partners Warn of SafePay Ransomware Activity

Summary: On October 20, the FBI, CISA, the U.S. Secret Service, and German and U.K. law enforcement partners released a joint #StopRansomware advisory on the SafePay ransomware group. Since August 2024, SafePay has affected at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia.

SafePay actors gain initial access through stolen or brute-forced credentials, phishing, and exploitation of known vulnerabilities in Cisco ASA (CVE-2020-3259, CVE-2023-20269), Veeam Backup & Replication (CVE-2023-27532, CVE-2024-40711), and SonicWall SonicOS (CVE-2024-40766). After gaining access, they move laterally using legitimate tools, such as PsExec, Windows Remote Management, and remote monitoring and management software. They also disable security software, exfiltrate data, and encrypt files with a .SafePay extension. The advisory includes indicators of compromise (IOCs) and mitigations.

Analyst Note: Patches have been available for all five vulnerabilities for well over a year. Backup infrastructure is a deliberate target: SafePay exploits Veeam flaws, stops the Volume Shadow Copy Service, and resets backup storage devices to factory settings. For a utility, losing backups can turn a contained IT incident into a prolonged recovery, especially if poor segmentation forces precautionary OT shutdowns. WaterISAC encourages members to:

• Confirm that affected Cisco, SonicWall, and Veeam products are patched and that backup servers are not internet-facing.
• Require multifactor authentication (MFA) for virtual private network (VPN) and remote access.
• Maintain offline, immutable backups and test restoration.
• Audit for unauthorized remote access tools such as AnyDesk and ScreenConnect.

Original Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a

Additional Reading:

• #StopRansomware Guide
• SafePay Ransomware: How a Non-RaaS Group Executes Rapid Fire Attacks