Feds Issues Advisory About SafePay Ransomware Group
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Secret Service (USSS), and cybersecurity agencies in Germany and the United Kingdom have issued a joint cybersecurity advisory about the SafePay ransomware group.
SafePay is a financially motivated threat group that has been in operation since August 2024 and targets businesses and critical infrastructure entities in North and South America, Europe, and Australia. The group engages in double extortion tactics, exfiltrating data, encrypting files with ransomware, and issuing ransom demands, payment of which is required to unlock files and prevent stolen data from being leaked online.
Just two months after the group was first identified, it attacked the U.S. business service provider Conduent Business Services and exfiltrated 8.5 terabytes of data. Conduent reported the incident as affecting 62.2 million individuals. The incident ranks as the third-largest U.S. healthcare data breach of all time. The group has accelerated attacks and is now one of the most prolific ransomware groups, having attacked more than 600 entities from multiple critical infrastructure sectors.
The security advisory includes the latest tactics, techniques, and procedures (TTPs) observed by the authoring agencies and security researchers. SafePay actors use a variety of techniques for initial access, including brute force password attacks, credential exposure, and vulnerability exploitation for edge devices, including the Cisco Adaptive Security Appliance vulnerabilities CVE-2023-20269 and CVE-2020-3259; the Veeam Backup & Replication vulnerabilities CVE-2023-27532 & CVE-2024-40711; and the SonicWall SonicOS vulnerability CVE-2024-40766. VPNs are also targeted, especially the Mullvad VPN provider, using phished account profiles.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Once networks are compromised, SafePay actors take over existing accounts or create new ones and use legitimate system tools for credential theft, network scanning, lateral movement, and data exfiltration. Valuable files are identified and exfiltrated, security protections are disabled, files are encrypted, and ransom notes are dropped.
The authorizing agencies recommend regularly patching and updating systems, prioritizing patches for the above-mentioned vulnerabilities and other known exploited vulnerabilities (KEVs). Administrative tools and privileges should be restricted, and the Zero Trust Principle should be implemented. Account security should be strengthened by implementing identity, credential, and access management (ICAM) policies and multifactor authentication. Indicators of Compromise (IoCs), detailed TTPs, and further recommendations are detailed in the security advisory.
