Skip to content

Hide Navigation Hide TOC

safepay (156a6b97-c64f-5742-a530-ea8415c746e3)

SafePay ransomware started in October 2024 as a new ransomware service, using some of the leaked LockBit source code. Soon after launching, the group made a big impact in the ransomware world, hacking at least 33 organizations by December 9.

The first version of SafePay was created by modifying the LockBit source code. It adds the ".safepay" extension to files that it encrypts and includes a ransom note called "readme_safepay.txt." This version uses a three-step XOR method with a random single-byte key, making it hard for security researchers to analyse.

The group's technical infrastructure includes both a dark web blog and a presence on the TON network for victim communications. Their attack methodology follows a double extortion model, combining traditional file encryption with data theft to maximise pressure on victims. SafePay operators typically move from initial access to ransomware deployment in under 24 hours, significantly faster than the industry average. . Among the Tactics, Techniques, and Procedures (TTPs) of the SafePay group, notable characteristics include the use of compromised VPN credentials as an initial access vector, extensive use of living-off-the-land binaries (LOLBins), and sophisticated privilege escalation techniques. The group frequently employs ShareFinder.ps1 for network reconnaissance and uses WinRAR for data archival before exfiltration. Post encryption, SafePay directs victims to their negotiation portal accessible through both Tor and TON networks.

The group has demonstrated sophisticated operational security measures, including a Cyrillic-language-based killswitch that prevents execution in eastern European countries.

Cluster A Galaxy A Cluster B Galaxy B Level
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Indirect Command Execution - T1202 (3b0e52ce-517a-4614-a523-1bd5deef6c5e) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Network Share Discovery - T1135 (3489cfc5-640f-4bb3-a103-9137b97de79f) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Remote Desktop Protocol - T1076 (51dea151-0898-4a45-967c-3ebee0420484) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Archive via Utility - T1560.001 (00f90846-cbd1-4fc5-9233-df5c2bf2a662) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Acquire Access - T1650 (d21bb61f-08ad-4dc1-b001-81ca6cb79954) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Disabling Security Tools - T1089 (2e0dd10b-676d-4964-acd0-8a404c92b044) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware External Remote Services - T1133 (10d51417-ee35-4589-b1ff-b6df1c334e8d) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) Attack Pattern 1
safepay (156a6b97-c64f-5742-a530-ea8415c746e3) Ransomware Exfiltration Over Alternative Protocol - T1048 (a19e86f8-1c0a-4fea-8407-23b73d615776) Attack Pattern 1
Remote Desktop Protocol - T1076 (51dea151-0898-4a45-967c-3ebee0420484) Attack Pattern Remote Desktop Protocol - T1021.001 (eb062747-2193-45de-8fa2-e62549c37ddf) Attack Pattern 2
Archive via Utility - T1560.001 (00f90846-cbd1-4fc5-9233-df5c2bf2a662) Attack Pattern Archive Collected Data - T1560 (53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a) Attack Pattern 2
Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) Attack Pattern Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b) Attack Pattern 2
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern Disabling Security Tools - T1089 (2e0dd10b-676d-4964-acd0-8a404c92b044) Attack Pattern 2
Remote Desktop Protocol - T1021.001 (eb062747-2193-45de-8fa2-e62549c37ddf) Attack Pattern Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba) Attack Pattern 3
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern 3