CISA AA26-293a: SafePay Ransomware Threat — Detection, Hunting, and Hardening Guide for Defenders

On October 20, 2026, CISA — in coordination with its #StopRansomware partners — published advisory AA26-293a detailing the TTPs of the SafePay ransomware operation. If you haven't tracked this group closely, now is the time to start: SafePay actors have been highly active since August 2024 and are targeting businesses and critical infrastructure organizations across North America, South America, Europe, and Australia. This is not a regional nuisance. This is an operationally mature, encryption-and-extortion crew with confirmed reach into critical sectors.

What makes SafePay worth your immediate attention is not exotic zero-days. It is the opposite: disciplined tradecraft built on the fundamentals that most organizations still get wrong. The advisory describes initial access through stolen or guessed credentials, exploitation of vulnerabilities in internet-facing security systems, and social engineering. Once inside, the actors create new accounts or hijack existing ones, move laterally using legitimate system tools (living off the land), stage and identify high-value data, and disable security controls before detonating encryption. Every one of those phases is detectable — if your telemetry and detections are actually tuned for them.

This post breaks down the SafePay intrusion chain from a defender's perspective, provides production-ready Sigma, KQL, and Velociraptor detection content, and closes with a prioritized remediation and hardening plan.

Technical Analysis

Who Is Affected

Per the advisory, SafePay has targeted businesses and critical infrastructure entities across four continents. There is no single vulnerable product or version to patch against — the entry vectors are identity weaknesses and edge-device exposure. Organizations most at risk share a common profile:

• Internet-facing remote access (VPN concentrators, firewalls, RDP gateways) protected by password-only authentication
• Service and local administrator accounts with weak, reused, or breached passwords
• Flat internal networks where a single compromised workstation grants broad lateral reach
• Endpoint security agents that can be disabled by local administrators without tamper protection

Attack Chain Breakdown

1. Initial Access (TA0001). SafePay actors gain entry three ways: password guessing/brute force against exposed remote access services, use of stolen credentials (purchased or harvested via infostealers and phishing), and exploitation of vulnerabilities in internet-facing security appliances — notably VPN and firewall platforms, which remain the most abused edge device class in ransomware intrusions this year. Social engineering rounds out the access toolkit, consistent with the broader industry shift toward help-desk and user-targeted pretexting.

2. Persistence and Privilege Escalation (TA0003, TA0004). Once on a foothold host, the actors create new local or domain accounts and/or take over existing accounts. New account creation — especially accounts added to privileged groups shortly after creation — is one of the highest-fidelity behavioral signals in the entire chain.

3. Lateral Movement via Living-off-the-Land (TA0008). SafePay operators rely on legitimate system and administrative tools rather than custom tooling for movement. Expect abuse of built-in Windows utilities, RDP, SMB administrative shares, and remote management frameworks already present in the environment. This is deliberate: LOLBin usage blends into administrative noise and defeats naive signature-based detections.

4. Discovery and Collection (TA0007, TA0009). The actors enumerate the network, identify file servers and valuable data repositories, and stage data for exfiltration — consistent with the double-extortion model the group operates under.

5. Defense Evasion and Impact (TA0005, TA0040). Before encryption, SafePay disables security tooling and undermines recovery — deleting shadow copies, tampering with endpoint agents, and modifying boot configuration. Mass file encryption follows, with extortion pressure applied via threat of data publication.

Exploitation Status

This is confirmed, active, in-the-wild activity against real victims — not theoretical. The advisory is a #StopRansomware publication, meaning it reflects observed intrusions across multiple victims and sectors. No specific CVE is named in the advisory summary; the exploited vulnerabilities in security systems are described generically. Do not invent a patch-centric response — the correct defensive posture is edge-device hardening, credential hygiene, and behavioral detection.

Detection & Response

The detections below target the highest-fidelity, lowest-noise behaviors in the SafePay chain: privileged account creation, shadow copy deletion, boot configuration tampering, and Defender tampering. Each was chosen because legitimate equivalents are rare enough to investigate every single hit.

Sigma Rules

---
title: SafePay Ransomware - Shadow Copy Deletion via vssadmin or wmic
id: 3f7a2c91-4d5e-4b8a-9c1d-2e6f8a0b3d5e
status: experimental
description: Detects deletion of volume shadow copies using vssadmin, wmic, or PowerShell, a hallmark pre-encryption step observed in SafePay ransomware intrusions.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'Win32_ShadowCopy'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate backup or storage maintenance scripts (rare in production)
level: high
---
title: SafePay Ransomware - Boot Configuration Tampering via bcdedit
id: 8c1e4b72-6a3f-4d29-8e5b-1c9a7f2d4e6b
status: experimental
description: Detects bcdedit being used to disable recovery options and ignore boot failures, consistent with SafePay pre-encryption system sabotage.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
      - 'deletevalue safeboot'
  condition: selection
falsepositives:
  - Rare; some system provisioning scripts modify boot configuration
level: high
---
title: SafePay Ransomware - New Local Admin Account Creation via net.exe
id: 5b9d3e14-7c2a-4f68-9a1c-3d8e6b0f5a2c
status: experimental
description: Detects creation of a new local user account immediately added to the local administrators group, matching SafePay persistence behavior of creating new accounts after initial access.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a
  - https://attack.mitre.org/techniques/T1136/001/
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'localgroup administrators'
      - '/add'
  condition: selection
falsepositives:
  - Help desk provisioning; correlate with account name and source host
level: medium

KQL — Microsoft Sentinel / Defender

This query chains two behaviors that should almost never co-occur: a brand-new local administrator account followed within six hours by shadow copy deletion or boot tampering on the same device. That sequence is a SafePay intrusion signature.

let Lookback = 7d;
let NewAdmins = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has_all ("localgroup", "administrators", "/add")
| project DeviceId, DeviceName, AdminAddTime=TimeGenerated, InitiatingAccountName, ProcessCommandLine;
let Sabotage = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
      or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
      or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Win32_ShadowCopy")
| project DeviceId, DeviceName, SabotageTime=TimeGenerated, SabotageCmd=ProcessCommandLine;
NewAdmins
| join kind=inner Sabotage on DeviceId
| where SabotageTime between (AdminAddTime .. AdminAddTime + 6h)
| project DeviceName, AdminAddTime, InitiatingAccountName, ProcessCommandLine, SabotageTime, SabotageCmd
| order by AdminAddTime desc;

A complementary hunt for Defender tampering across the fleet:

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any (
    "Set-MpPreference -DisableRealtimeMonitoring",
    "Set-MpPreference -DisableBehaviorMonitoring",
    "Set-MpPreference -DisableIOAVProtection",
    "Add-MpPreference -ExclusionPath"
)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc;

Velociraptor VQL

Use this hunt artifact across your Windows fleet to surface hosts exhibiting pre-encryption sabotage or suspicious new-account tooling execution:

-- SafePay ransomware pre-encryption behavior hunt
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures|Win32_ShadowCopy|DisableRealtimeMonitoring)'
   OR (Name =~ '(?i)^(net|net1)\.exe$' AND CommandLine =~ '(?i)localgroup administrators.*add')

Remediation Script

The following PowerShell script performs an audit-and-harden pass aligned to the SafePay intrusion chain: it identifies recently created local administrator accounts, verifies shadow copy and recovery configuration integrity, checks Defender tamper protection status, and flags RDP exposure. Run it as a scheduled audit or during IR triage.

# SafePay Ransomware Defensive Audit — run elevated
# 1) Flag local admins created in the last 30 days
Write-Host "=== Recently Created Local Administrator Accounts ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-30)
$admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue
foreach ($m in $admins) {
    if ($m.ObjectClass -eq 'User' -and $m.PrincipalSource -eq 'Local') {
        $u = Get-LocalUser -Name ($m.Name -split '\\')[-1] -ErrorAction SilentlyContinue
        if ($u -and $u.PasswordLastSet -gt $cutoff) {
            Write-Warning "Suspicious recent local admin: $($u.Name) | Enabled: $($u.Enabled) | PasswordSet: $($u.PasswordLastSet)"
        }
    }
}

# 2) Verify shadow copies exist and recovery is enabled
Write-Host "=== Shadow Copy & Boot Recovery Integrity ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Warning "No shadow copies present — recovery capability may be degraded." }
$bcd = bcdedit /enum "{current}" 2>$null | Out-String
if ($bcd -match 'recoveryenabled\s+No') { Write-Warning "Boot recovery DISABLED — consistent with ransomware sabotage." }
if ($bcd -match 'ignoreallfailures') { Write-Warning "bootstatuspolicy=ignoreallfailures — investigate immediately." }

# 3) Check Defender tamper protection and exclusions
Write-Host "=== Defender Posture ===" -ForegroundColor Cyan
$mp = Get-MpComputerStatus
if ($mp.IsTamperProtected -ne $true) { Write-Warning "Tamper Protection is OFF. Enable it via Intune/MEM or GPO." }
if ($mp.RealTimeProtectionEnabled -ne $true) { Write-Warning "Real-time protection DISABLED." }
$excl = (Get-MpPreference).ExclusionPath
if ($excl) { Write-Warning "Defender exclusions present: $($excl -join ', ') — validate each is authorized." }

# 4) Harden: re-enable recovery and confirm protection
bcdedit /set "{current}" recoveryenabled Yes
Set-MpPreference -DisableRealtimeMonitoring $false
Write-Host "=== Audit Complete ===" -ForegroundColor Green

Remediation

There is no single patch for SafePay because there is no single bug — the advisory describes technique-driven intrusions. Remediation is architectural. Prioritize in this order:

1. Close the front door. Enforce phishing-resistant MFA on every remote access path — VPN, RDP gateways, cloud portals. Password-only remote access is the single most common SafePay entry condition described in the advisory. If MFA cannot be deployed immediately on an edge device, take it off the internet until it can.

2. Patch and harden edge security appliances. The actors exploit vulnerabilities in security systems — VPNs and firewalls. Inventory every internet-facing security appliance, confirm current firmware against vendor advisories, and subscribe to vendor PSIRT feeds. Treat edge devices as Tier 0 assets.

3. Control credential exposure. Audit for weak and reused passwords (run periodic password-spray testing against your own environment), eliminate local admin password reuse with LAPS, and disable NTLM where feasible. Reset credentials for any account found in infostealer logs or breach corpora.

4. Deploy the detections above. The new-admin-plus-sabotage correlation is your highest-fidelity tripwire. Pair it with EDR isolation-on-detection policies so a confirmed hit triggers automatic host containment.

5. Protect recovery. Enable tamper protection fleet-wide, restrict who can modify boot configuration and shadow copies, and maintain offline/immutable backups tested with regular restore exercises. SafePay's model assumes it can destroy your recovery path — prove that assumption wrong.

6. Segment for blast-radius control. SafePay's LOLBin-driven lateral movement succeeds on flat networks. Enforce tiered administration, restrict SMB/RDP between workstation VLANs, and require jump hosts for server administration.

7. Pressure-test with your own red team or an external assessment. Validate that MFA, segmentation, and the detections above actually hold against a simulated intrusion following this exact TTP chain.

If you suspect active SafePay presence: isolate affected hosts at the network layer first, preserve volatile evidence before rebooting anything, and report to CISA via report@cisa.gov or your regional cybersecurity authority. The full advisory is available at https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a — review the complete IOC and mitigation sections against your environment this week, not next quarter.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub