It’s Not Safe To Pay SafePay | Huntress

Category	Details
Threat Actors	SafePay Ransomware group; obscure cybercrime gang with limited discussion on illicit forums.
Campaign Overview	Observed in October 2024; involved deployment of SafePay ransomware with the encrypted file extension .safepay and ransom note readme_safepay.txt.
Target Regions/Victims	Affected multiple business verticals and geographies; 22 victims listed on the group’s leak site.
Methodology	- Access via Remote Desktop Protocol (RDP) - Data exfiltration using tools like WinRAR and FileZilla - Encryption executed through regsvr32.exe with flags for UAC bypass, self-delete, and network propagation.
Product Targeted	Windows-based systems, especially those running Microsoft Defender.
Malware Reference	Derived from Lockbit ransomware with Cyrillic language killswitch and string encryption using XOR loop.
Tools Used	- WinRAR for archiving - FileZilla for FTP - regsvr32.exe for ransomware execution - PowerShell scripts like ShareFinder.ps1.
Vulnerabilities Exploited	Windows Defender settings disabled via GUI; likely UAC bypass using COM Object (e.g., CMSTPLUA).
TTPs	- Defense evasion by disabling Defender - Data exfiltration before encryption - Privilege escalation using token impersonation and ZwSetThreadInformation.
Attribution	Analysts noted similarities to Lockbit, potentially indicating code reuse from leaked Lockbit samples.
Recommendations	- Monitor unusual Defender settings changes and privilege escalation activities - Use Sigma rules to detect Defender RTP changes and WinRAR misuse - Enhance RDP security protocols.
Source	Huntress Blog

Read full article: Read More
Disclaimer: The above summary has been generated by an AI language model.