SafePay Ransomware Strikes 260+ Victims Across Multiple Countries

The SafePay ransomware organization has quickly become a powerful operator since its initial detection in September 2024, marking a startling increase in the cyber threat scenario.

Unlike predominant ransomware-as-a-service (RaaS) models that rely on affiliates for dissemination and profit-sharing, SafePay operates autonomously, with its core developers directly orchestrating intrusions and extortion campaigns.

This self-contained approach has enabled the group to claim responsibility for over 265 victims globally by early 2025, marking a sharp increase from just over 20 targets in 2024.

Self-Operated Ransomware Threat

The group’s double-extortion strategy involves not only encrypting victims’ files with robust algorithms but also exfiltrating sensitive data for leverage, threatening publication on a dedicated Dark Web leak site (DLS) if cryptocurrency ransoms remain unpaid.

SafePay’s aggressive tactics have disrupted operations across diverse sectors, underscoring the evolving sophistication of non-affiliate ransomware operations that prioritize precision and evasion over widespread affiliate-driven proliferation.

Emerging almost undetected until its sudden surge, SafePay has leveraged a modular ransomware binary configurable via command-line parameters, allowing tailored encryption of specific drives while incorporating self-deletion mechanisms post-execution.

The malware embeds geofencing checks that terminate operations on systems using languages such as Armenian, Azerbaijani (Cyrillic), Belarusian, Georgian, Kazakh, Russian, or Ukrainian, effectively sparing Commonwealth of Independent States (CIS) regions a common indicator of threat actors avoiding jurisdictions with potential affiliations or prosecutorial risks.

This selective targeting aligns with SafePay’s focus on developed economies, where high-value payouts are more feasible, further evidenced by their avoidance of CIS-aligned domains and infrastructures.

Targets, Techniques, and Defensive Strategies

SafePay’s victimology reveals a pronounced emphasis on North America and Western Europe, with the United States bearing the brunt at 103 confirmed incidents comprising nearly 40% of cases followed by Germany with 47.

Additional strikes span the United Kingdom, Australia, Canada, and select Latin American and Asian nations, predominantly affecting manufacturing, technology, education, business services, and healthcare sectors, alongside transportation, finance, agriculture, and public services.

This broad industrial targeting exploits organizations susceptible to operational downtime, where the pressure to restore access often outweighs the risks of non-payment.

Operationally, SafePay adheres to a refined cyber kill chain, initiating access through stolen credentials procured from Dark Web markets or infostealer campaigns, often bypassing multi-factor authentication (MFA) via misconfigured firewalls or phishing/vishing hybrids involving real-time social engineering over platforms like Microsoft Teams.

Post-breach, execution leverages living-off-the-land binaries (LotL) such as regsvr32 and cmd.exe for code injection into legitimate processes, while persistence is achieved via tools like ConnectWise ScreenConnect or custom backdoors like QDoor, obfuscated for anti-analysis.

Privilege escalation exploits tools like Mimikatz for credential dumping and user account control (UAC) bypasses, enabling defense evasion through antivirus disablement, Group Policy manipulations, and deletion of event logs and volume shadow copies.

Lateral movement utilizes RDP and administrative shares, with data exfiltration conducted via FileZilla or Rclone to siphon gigabytes of compressed archives.

According to the report, the impact culminates in file encryption appending the .safepay extension, accompanied by readme_safepay.txt notes directing victims to TON-hosted portals for negotiations.

Mitigation against SafePay demands a multifaceted defense-in-depth posture, emphasizing fortified access controls with enforced MFA, unique passwords, and regular account audits to thwart initial credential abuse.

System hardening through timely patching of VPNs, RDP endpoints, and exposed services, coupled with endpoint detection and response (EDR) monitoring for anomalous behaviors like LSASS access or unusual PowerShell invocations, can disrupt execution and lateral phases.

Restricting abusable utilities, detecting ransomware-specific indicators such as mass file modifications or unauthorized remote tools, and maintaining isolated offline backups with tested restoration protocols further bolster resilience.

User training on phishing recognition and incident response simulations, integrated with network segmentation, ensures rapid containment, minimizing the extortion leverage of this increasingly prolific threat actor.

As SafePay continues its unchecked expansion, organizations must prioritize these technical safeguards to counter its autonomous, high-impact methodology.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!