Overview

SafePay is a closed, centrally run ransomware crew that went from newcomer to one of the most prolific extortion groups in under two years. Researchers first spotted it around November 2024, and by the first quarter of 2025 it had already claimed more than 200 victims worldwide, many of them managed service providers (MSPs) and small and mid-sized businesses (SMBs). 

What sets SafePay apart is that it does not rent out its malware. There is no ransomware-as-a-service (RaaS) program and no affiliate network. The same core team breaks in, steals the data, deploys the encryptor, and runs the negotiation, which gives it tight control over every stage of an attack. 

The group’s encryptor borrows heavily from LockBit 3.0 (also known as LockBit Black), and its intrusion style leans exposed remote access, stolen or weak credentials, and native Windows tools. In July 2025, it disrupted operations at Ingram Micro, a major IT infrastructure and distribution provider, showing how much supply-chain damage a single SafePay intrusion can cause. 

On October 20, 2026, the FBI, CISA, and international partners published a joint advisory tying SafePay to at least 600 victims across multiple critical infrastructure sectors since August 2024, and ranking it among the most active ransomware groups of 2026. 

Origin, Targeting and Reach

SafePay’s start date depends on who is counting. Early industry reporting places its first appearance around November 2024, while the October 2026 joint advisory traces victim impact back to August 2024. The advisory indicator set covers activity from November 2024 through August 2026. 

The group’s growth curve is steep. It crossed 200 victims in Q1 2025 and had passed 600 by the time of the advisory. Government reporting highlights victims in North America, South America, Europe and Australia, but tracked activity also reaches into Asia, the Caribbean and the Middle East. 

SafePay’s intended victims include MSPs, SMBs, financial firms, legal practices, healthcare providers, infrastructure operators, manufacturers, schools and supply-chain businesses. MSPs and suppliers are especially valuable to the group because one breach can open the door to many downstream customers. 

Target Countries

Region	Countries
North America and Caribbean (8)	United States, Canada, Mexico, Puerto Rico, Bermuda (BM), Barbados, Jamaica, Curaçao (CW)
Central and South America (7)	Argentina, Chile, Colombia, Peru, Paraguay, Guatemala, El Salvador
Europe (20)	Austria, Belgium, Croatia, Cyprus, Czech Republic, Finland, France, Germany, Greece, Ireland, Italy, Lithuania, Netherlands, Poland, Portugal, Romania, Spain, Sweden, Switzerland, United Kingdom
Middle East (1)	Israel
Asia-Pacific (8)	Australia, New Zealand, Japan, South Korea, Taiwan, Singapore, Malaysia, Cambodia

Target Industries 

Aerospace & Defense; Agriculture & Livestock; Automotive; BFSI; Chemicals; Construction; Consumer Goods; Critical Infrastructure; Education; Energy & Utilities; Food & Beverages; Government & LEA; Healthcare; Hospitality; IT & ITES; Manufacturing; Media & Entertainment; Metals, Minerals & Mining; Organization; Pharmaceuticals & Biotechnology; Professional Services; Real Estate; Retail; Technology; Telecommunication; Transportation & Logistics. 

The breadth of this list points to opportunistic targeting. SafePay goes after whatever it can reach through a weak VPN, an exposed RDP port or an unpatched edge device, rather than hunting one sector. 

Malware Arsenal 

SafePay pairs one custom encryptor with a toolkit of legitimate software turned against its owners. Four families are formally linked to the group, and investigations have surfaced several supporting tools around them. 

Tool	Type	Role in intrusions
SafePay	Ransomware	LockBit 3.0-derived Windows encryptor that locks files with a ChaCha20/RSA hybrid scheme and tags them .safepay
AnyDesk	Remote access (abused as backdoor)	Interactive control of victim hosts and delivery of the ransomware payload
TeamViewer	Remote access (abused as backdoor)	Same role as AnyDesk: hands-on access and payload transfer
FileZilla	File transfer (abused for exfiltration)	Moves stolen data out over FTP, FTPS or SFTP before encryption

AnyDesk 

A legitimate, fast remote desktop product. Attackers abuse it by installing it themselves or by tricking users into running a malicious copy, which hands them quiet, persistent access to the device and whatever data sits on it. 

TeamViewer 

A cross-platform remote control and support tool covering computers, mobile devices, servers and IoT gear. In SafePay intrusions it serves as an unauthorized access channel to sensitive systems and a way to push tools and payloads. 

FileZilla 

An open-source FTP, FTPS and SFTP client known for its simple interface. Its normal job is moving files securely across the internet, which is exactly why it makes an effective exfiltration tool that blends in with routine traffic. 

Supporting Tooling Seen in Investigations 

• QDoor backdoor (soc.dll): a UPX-packed DLL that provides remote access and keeps a foothold in the network. It uses RunPE to hollow out WerFault.exe and run inside it. 

• ScreenConnect: installed as an auto-starting Windows service, most likely for long-term access. 

• Mimikatz: credential dumping. 

• ShareFinder.ps1 and SharpShares.exe: network share discovery to locate valuable data. 

• PsExec, Windows Remote Management (WinRM) and RDP: remote execution and lateral movement. 

• 7-Zip and WinRAR: compressing data for theft. 

• WinSCP, RClone, OneDrive and Backblaze’s b2.exe command-line tool: data exfiltration channels alongside FileZilla. 

Inside the Encryptor 

SafePay’s payload is a reworked descendant of LockBit 3.0 (LockBit Black), tuned to slow down analysts and to finish encryption quickly. Reverse engineering has turned up the fingerprints of that lineage: 

• leftover compile-time artifacts 

• dummy API call loops that waste an analyst’s time and confuse automated sandboxes 

• encrypted strings, unlocked at runtime with custom XOR decoding routines 

• self-deletion once encryption is complete 

Cryptography 

Early analyses described the scheme as AES combined with RSA. The October 2026 advisory describes it as a hybrid of the ChaCha20 stream cipher and RSA public-key encryption. Either way, the agencies state that files cannot be recovered without the attacker’s decryption key. 

Speed Through Partial Encryption 

The malware works through files in 10 MB blocks. When launched with the -enc=1 flag, it encrypts only 1 MB of each block, which damages files beyond use while cutting encryption time sharply. Each encrypted file gets a metadata trailer holding the public key, a validation hash and the encryption percentage that was applied. 

Victim-facing Markers 

Encrypted files take the .safepay extension (written .SafePay in the advisory), and the ransom note, readme_safepay.txt, is dropped on the desktop or in the root directory. 

CIS Kill Switch

Before doing anything harmful, the encryptor checks the system language. If it matches Russian, Ukrainian, Belarusian or another Commonwealth of Independent States (CIS) locale, it stops. This is a common trait of Russian-speaking criminal groups, and it suggests either a geographic base in the region or a deliberate effort to avoid trouble with local authorities.

Attack Chain

A typical SafePay intrusion is hands-on from start to finish. The operators get in through remote access, live off the land, take the data and only then pull the trigger on encryption. 

1. Initial access. Operators enter through exposed RDP, VPN gateways or misconfigured perimeter devices. Common routes include FortiGate and GlobalProtect VPNs with weak policies, domain admin accounts with guessable passwords, brute force, phishing and stolen credentials. In one documented case, a FortiGate policy let local and LDAP users authenticate over VPN without MFA. In another, authentication logs showed a domain administrator account being used from a VPS-hosted system (vultr-guest). 

2. Exploitation of edge and exposed systems. Using Mullvad VPN IP addresses and phished account profiles, the group exploits CVE-2020-3259 and CVE-2023-20269 in edge devices. Automated scripts target CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 on internet-facing systems. 

3. Persistence. The attackers grant themselves admin rights on existing accounts or create new ones. They also install backdoors such as QDoor (soc.dll) and set up ScreenConnect as an auto-start service. 

4. Privilege escalation. Mimikatz harvests credentials. A UAC bypass, token impersonation (DuplicateToken and ZwSetInformationThread) and creating processes with elevated tokens give the operators full control. 

5. Discovery and lateral movement. ShareFinder.ps1 and SharpShares.exe map network shares. PsExec, WinRM, RDP and batch scripts such as C:\ProgramData<digit>.bat carry the attackers across the network. 

6. Defense evasion. Security software is switched off before lateral movement, Windows Defender is disabled and logs are wiped. In some cases the attackers change users’ passwords to lock legitimate staff out. 

7. Exfiltration. Data is packed with 7-Zip or WinRAR and shipped out via FileZilla, WinSCP, RClone, OneDrive or b2.exe. Archives and tools such as WinRAR and FileZilla are then deleted to cover tracks. 

8. Recovery sabotage. The Volume Shadow Copy Service is stopped, shadow copies are removed, services such as vss and sqlsvc are halted, and NAS devices holding backups are reset to factory settings. 

9. Encryption. AnyDesk or TeamViewer is used to deliver the ransomware, which encrypts files, appends the extension, drops readme_safepay.txt and may then delete itself. 

10. Extortion. Victims log in to a Tor chat portal with an ID from the note, field pressure calls and face publication of their data if they refuse to pay. 

The October 2026 Joint Advisory 

The clearest official picture of SafePay comes from a joint cybersecurity advisory published on October 20, 2026. It confirms at least 600 victims since August 2024 and names SafePay among 2026’s most active ransomware operations. 

Six agencies co-authored the advisory, drawing on investigations that ran as late as August 2026:  

• Federal Bureau of Investigation (FBI) 

• Cybersecurity and Infrastructure Security Agency (CISA) 

• United States Secret Service 

• Landeskriminalamt Rheinland-Pfalz (Germany) 

• National Crime Agency (United Kingdom) 

• North West Regional Organised Crime Unit (United Kingdom) 

Vulnerabilities Exploited 

CVE	Where it is used
CVE-2020-3259	Edge devices, reached through Mullvad VPN IPs and phished account profiles
CVE-2023-20269	Edge devices, reached through Mullvad VPN IPs and phished account profiles
CVE-2023-27532	Internet-facing systems, hit with automated scripts
CVE-2024-40711	Internet-facing systems, hit with automated scripts
CVE-2024-40766	Internet-facing systems, hit with automated scripts

The advisory confirms the living-off-the-land toolkit described above, the ChaCha20/RSA hybrid encryption, revenue-based ransom demands, phone-based pressure and possible self-deletion of the payload.  

It also publishes IP addresses, file names, hashes, and hostnames observed between November 2024 and August 2026. The agencies caution that these indicators should be checked before blocking, because some IP addresses may since have been handed to legitimate services. 

The authoring agencies discourage ransom payments, pointing out that paying does not guarantee files will come back. US victims can report to the FBI’s Internet Crime Complaint Center (IC3), a local FBI or Secret Service field office, or CISA. UK victims can report through Report Fraud or their local police force. 

Extortion and Negotiation 

SafePay runs a classic double-extortion play: it encrypts the victim’s systems and also threatens to publish the data it stole. Its leak site is reachable over both Tor and The Open Network (TON), and lists victim organizations alongside dumps of their data. 

• The ransom is usually pegged to a slice of the victim’s revenue and paid in cryptocurrency, typically Bitcoin or Monero. 

• The ransom note links to a Tor chat portal, where victims sign in with their unique ID. Operators often present themselves as helpful and professional, offering payment walkthroughs, FAQs and promises of working decryption. Those promises should not be taken at face value. 

• A SafePay representative may phone the victim directly to push for payment. If the victim refuses, the stolen data goes up on the leak site. 

• The group has been seen keeping watch over compromised email systems after the breach. That lets it read messages between the victim and outside incident responders or law enforcement and adjust its negotiating stance to match. Victims should assume their internal email is compromised and move response conversations to a separate, clean channel. 

MITRE ATT&CK Mapping

The mapping below covers the techniques attributed to SafePay in investigative reporting. Several techniques serve more than one tactic, so they appear more than once. 

• Initial Access (TA0001) – Domain Accounts (T1078.002): Exploits weak credentials to take over a domain administrator account, with authentication logs tracing the logins to a VPS-hosted machine (vultr-guest). 

• Initial Access (TA0001) – External Remote Services (T1133): Deploys the QDoor backdoor (soc.dll) to establish remote access and keep control over the network. 

• Initial Access (TA0001) – Exploit Public-Facing Application (T1190): Abuses a misconfigured FortiGate firewall policy that allows local and LDAP users to authenticate over VPN without MFA. 

• Execution (TA0002) – Windows Command Shell (T1059.003): Runs batch scripts such as C:\ProgramData\<digit>.bat to carry out discovery, lateral movement, and ransomware deployment. 

• Execution (TA0002) – Service Execution (T1569.002): Interacts with Windows services to stop processes such as vss and sqlsvc ahead of encryption. 

• Persistence (TA0003) – Domain Accounts (T1078.002): Relies on the compromised domain administrator account to retain long-term access to the environment. 

• Persistence (TA0003) – External Remote Services (T1133): Uses the QDoor backdoor (soc.dll) to maintain a persistent remote foothold. 

• Persistence (TA0003) – Windows Service (T1543.003): Installs ScreenConnect as a Windows service configured to start automatically, likely for long-term access. 

• Privilege Escalation (TA0004) – Process Hollowing (T1055.012): Injects malicious code into a suspended, hollowed-out legitimate process to run it under a trusted identity. 

• Privilege Escalation (TA0004) – Domain Accounts (T1078.002): Gains domain administrator privileges through weak credentials. 

• Privilege Escalation (TA0004) – Token Impersonation/Theft (T1134.001): Duplicates and applies access tokens using DuplicateToken and ZwSetInformationThread to impersonate privileged users. 

• Privilege Escalation (TA0004) – Create Process with Token (T1134.002): Uses elevated tokens to spawn privileged threads for enumeration and encryption. 

• Privilege Escalation (TA0004) – Windows Service (T1543.003): Runs the ScreenConnect service with elevated rights to retain high-level control. 

• Defense Evasion (TA0005) – Software Packing (T1027.002): Packs the QDoor DLL with UPX to obscure its contents from security tools. 

• Defense Evasion (TA0005) – Process Hollowing (T1055.012): Uses RunPE to hollow out WerFault.exe and execute QDoor inside it, masking activity behind a legitimate Windows process. 

• Defense Evasion (TA0005) – File Deletion (T1070.004): Removes the ransomware payload with a self-delete flag and erases archives and tools such as WinRAR and FileZilla after exfiltration. 

How Process Hollowing Works? 

The attacker launches a legitimate program in a suspended state, typically with CreateProcess. It then unmaps that program’s memory using NtUnmapViewOfSection or ZwUnmapViewOfSection, writes its own code into the empty space with VirtualAllocEx and WriteProcessMemory, redirects execution with SetThreadContext and restarts the process with ResumeThread.  

The malicious code now runs under a trusted process name. Because the hollowed process inherits the rights of the process that created it, the main benefit is stealth rather than higher privileges. In SafePay’s case, the host was WerFault.exe, the Windows error-reporting process. 

Mitigations and Recommendations 

Most SafePay intrusions start at the perimeter with a weak password or an unpatched device, so the first defenses belong there. The recommendations below combine the joint advisory’s guidance with lessons from observed attacks. 

• Prioritize known exploited vulnerabilities on firewalls, VPNs and other internet-facing systems, starting with CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. 

• Make MFA mandatory on webmail, VPNs and every account that touches critical systems. Audit FortiGate and GlobalProtect policies for local or LDAP logins that skip MFA. 

• Require passwords of 15 to 64 characters, lock accounts after repeated failed attempts and watch for logins from VPS ranges or commercial VPN services such as Mullvad. 

• Close exposed RDP and put remote access behind a VPN with MFA. 

• Maintain offline, encrypted and immutable backups, and protect NAS management interfaces against factory resets. 

• Segment the network, enforce least privilege, use time-limited admin access and limit who can run command-line and scripting tools. 

• Keep an inventory of approved tools and alert on unauthorized AnyDesk, TeamViewer or ScreenConnect installs or service creation. 

• Alert on shadow copy deletion, VSS or SQL service shutdowns, Mimikatz activity, PsExec and WinRM use from unusual accounts, and runs of ShareFinder.ps1 or SharpShares.exe. 

• Flag large outbound transfers through FileZilla, WinSCP, RClone, OneDrive or b2.exe, especially after 7-Zip or WinRAR archiving. 

• Validate the published IPs, file names, hashes and hostnames against current data before blocking, since some IPs may now belong to benign services. 

• Assume the attackers can read corporate email and use a separate channel to talk with responders and law enforcement. 

Conclusion 

SafePay has shown how far a disciplined, closed team can go without an affiliate army. In less than two years it climbed from roughly 200 victims in early 2025 to more than 600 by October 2026, reaching 44 countries and 26 industries along the way. 

Its methods are rarely new. Weak VPN policies, exposed RDP, unpatched edge devices, LockBit-derived code and off-the-shelf remote access tools do most of the work. What makes the group dangerous is how consistently it executes: it steals data before encrypting, destroys recovery options, watches the victim’s email during negotiations and applies pressure by phone. 

The Ingram Micro disruption and the group’s focus on MSPs make the supply-chain risk especially real. Organizations that close perimeter gaps, enforce MFA everywhere and keep immutable backups take away most of what SafePay depends on. 

Frequently Asked Questions (FAQs) about the SafePay Ransomware Group

What is SafePay? 

A ransomware group active since late 2024 (August 2024 per the joint advisory, November 2024 per early industry reporting). It runs every stage of its attacks in-house rather than through a RaaS affiliate model. 

How big is it? 

It had more than 200 victims by Q1 2025 and at least 600 by October 2026, across 44 countries and 26 industries. 

How does SafePay get in? 

Through exposed RDP, misconfigured VPNs such as FortiGate and GlobalProtect, weak or stolen credentials, brute force and phishing. It also exploits CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. 

Is SafePay related to LockBit? 

Its encryptor is a modified LockBit 3.0 (LockBit Black) derivative, with compile-time artifacts, dummy API loops, encrypted strings and custom XOR decoding. 

How does it encrypt files? 

With a hybrid scheme, described as ChaCha20 plus RSA in the 2026 advisory and as AES plus RSA in earlier analysis. Files are processed in 10 MB blocks, and only 1 MB per block is encrypted when the -enc=1 flag is set. 

What are the signs of a SafePay attack? 

Files renamed with the .safepay extension, a ransom note named readme_safepay.txt on the desktop or in the root directory, stopped shadow copy services, wiped backups and possibly locked-out user accounts. 

Does it avoid any countries? 

Yes. The malware stops if the system language is Russian, Ukrainian, Belarusian or another CIS language. 

How do victims contact the attackers? 

Through a Tor chat portal using a victim ID from the ransom note. Operators may also call victims by phone. 

Should victims pay? 

The FBI, CISA and partner agencies advise against it, since payment does not guarantee recovery. Incidents can be reported to IC3, an FBI or Secret Service field office, CISA, or in the UK to Report Fraud or local police. 

Disclaimer: This profile was compiled from open-source security reporting and the October 20, 2026 joint cybersecurity advisory. It is provided for reference only. Validate all indicators against internal telemetry before operational use.