SafePay Ransomware: 600+ Organizations Breached via Stolen VPN Credentials — Joint FBI/CISA Advisory Defense Guide

This week, CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies published a joint advisory on SafePay, a ransomware operation that has compromised more than 600 organizations since 2024. When five agencies across three countries co-author an advisory, the operational tempo is significant — and SafePay has earned that attention by becoming one of the most active ransomware groups currently in the wild.

The advisory's core finding is one I've seen play out in dozens of IR engagements: SafePay doesn't need zero-days. Its operators gain initial access primarily through stolen credentials used against VPN gateways and remote access infrastructure, then execute a classic double-extortion playbook — exfiltrate sensitive data first, encrypt second, and threaten public disclosure to force payment. If your organization exposes VPN concentrators or RDP to the internet without phishing-resistant MFA, you are in SafePay's target set.

This post breaks down the attack chain and delivers the detection content, hunting queries, and hardening steps your team needs this week — not next quarter.

Technical Analysis

Who Is Being Targeted

Per the joint advisory, SafePay has struck organizations across critical infrastructure sectors — healthcare, manufacturing, IT services, and professional services — with a victim count exceeding 600 since the group emerged in late 2024. The group operates a data leak site and follows a double-extortion model: victims face both operational disruption from encryption and reputational/regulatory damage from threatened data publication.

No CVE is associated with this campaign. That is precisely the point. SafePay's intrusion vector is valid credential abuse against perimeter remote access services, not software exploitation. This means vulnerability scanners will not flag your exposure — only identity telemetry, authentication logging, and network edge monitoring will.

Attack Chain (Defender's View)

Based on the joint advisory and the TTPs consistent with SafePay intrusions, the kill chain breaks down as follows:

1. Initial Access (T1078 — Valid Accounts): Operators authenticate to internet-facing VPN appliances and remote access portals using credentials obtained from prior breaches, credential-stuffing lists, infostealer logs, or brute-force/password-spray campaigns against accounts lacking MFA.
2. Discovery & Defense Evasion: Once on the internal network, operators enumerate the environment, escalate privileges, and tamper with security tooling. SafePay intrusions characteristically include deletion of Volume Shadow Copies via vssadmin.exe or wmic.exe to inhibit recovery, and efforts to disable endpoint protection before encryption.
3. Collection & Exfiltration (T1041/T1567): Data is staged and exfiltrated to attacker-controlled infrastructure before encryption is triggered. This is the double-extortion leverage — the encryption event is often the last observable action, not the first.
4. Impact (T1486 — Data Encrypted for Impact): The SafePay encryptor is deployed, typically after hours, with ransom notes dropped across encrypted hosts and the victim named on the leak site if payment stalls.

Exploitation Status

• Active exploitation: Confirmed. 600+ victim organizations since 2024.
• CISA KEV: Not applicable — this campaign abuses valid accounts and misconfigurations rather than a specific CVE.
• Attribution confidence: High. Five-agency joint advisory with corroborated victimology.

Detection & Response

The detections below target the behaviors defenders can actually observe: anomalous VPN authentication, shadow copy deletion, and pre-encryption staging. These are the choke points where SafePay intrusions can be interrupted before data leaves your network.

SIGMA Rules

---
title: Volume Shadow Copy Deletion via vssadmin or wmic
id: 9b3e1a4c-7f2d-4e8a-b5c6-2a1d4e9f0c83
status: experimental
description: Detects deletion of volume shadow copies using vssadmin or wmic, a hallmark ransomware defense-evasion behavior observed in SafePay intrusions prior to encryption.
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://www.cisa.gov/news-events/cybersecurity-advisories
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy delete'
      - 'shadowcopy call delete'
  condition: 1 of selection_*
falsepositives:
  - Rare; legitimate backup maintenance scripts using vssadmin
level: high
---
title: Suspicious Process Spawned from VPN or Remote Access Service Context
id: 4c7d2e1a-8b3f-4a9c-d6e5-1f0a8b2c3d94
status: experimental
description: Detects interactive command shells or discovery commands executed shortly after VPN session establishment, consistent with hands-on-keyboard activity following valid-account access in SafePay intrusions.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1078
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_shells:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_discovery:
    CommandLine|contains:
      - 'net user /domain'
      - 'net group "domain admins"'
      - 'nltest /dclist'
      - 'whoami /all'
      - 'ipconfig /all'
      - 'systeminfo'
  condition: selection_shells and selection_discovery
falsepositives:
  - Helpdesk and administrator enumeration activity; tune against known admin accounts and jump hosts
level: medium
---
title: Windows Security Event Log Cleared
id: 7e2a9f41-3c8d-4b6a-a1e7-5d0c9f3b8a62
status: experimental
description: Detects clearing of the Windows Security event log via wevtutil or native event log clearing, a defense-evasion step frequently performed by ransomware operators including SafePay prior to encryption deployment.
references:
  - https://attack.mitre.org/techniques/T1070.001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - 'cl security'
      - 'cl system'
      - 'cl application'
      - 'clear-log security'
  condition: selection
falsepositives:
  - Infrequent; some log rotation tooling. Correlate with the executing account.
level: high

KQL — Microsoft Sentinel / Defender Hunting

The first query hunts VPN authentication anomalies via CommonSecurityLog (CEF-ingested firewall/VPN appliance logs). The second hunts shadow copy deletion and staging behavior on endpoints.

// Hunt 1: Anomalous VPN authentication — failed-to-success sequences and off-hours logons
// Ingests VPN concentrator logs via CEF/Syslog into CommonSecurityLog
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor in ("Cisco", "Fortinet", "Palo Alto Networks", "SonicWall", "Citrix", "Pulse Secure")
| where DeviceEventClassID has_any ("vpn", "sslvpn", "auth") or Message has "VPN"
| summarize
    FailedAttempts = countif(Activity has_any ("fail", "deny", "reject")),
    SuccessfulLogons = countif(Activity has_any ("success", "accept", "login")),
    SourceIPs = make_set(SourceIP),
    Countries = make_set(SourceCountry),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by DestinationUserName, bin(TimeGenerated, 1h)
| where FailedAttempts >= 3 and SuccessfulLogons >= 1   // brute force followed by success
   or array_length(Countries) > 1                        // impossible geography within the hour
| project TimeGenerated, DestinationUserName, FailedAttempts, SuccessfulLogons, SourceIPs, Countries, FirstSeen, LastSeen
| order by FailedAttempts desc;

// Hunt 2: Shadow copy deletion and pre-encryption staging on endpoints
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
   or (FileName =~ "wevtutil.exe" and ProcessCommandLine has_any ("cl security", "clear-log"))
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled no")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated asc;

Velociraptor VQL — Endpoint Hunt

-- Hunt for ransomware pre-encryption behaviors: shadow copy deletion, log clearing,
-- and recovery-disable commands across the fleet
SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       _Source
FROM pslist()
WHERE (Exe =~ '(?i)vssadmin\.exe$' AND CommandLine =~ '(?i)delete shadows')
   OR (Exe =~ '(?i)wmic\.exe$' AND CommandLine =~ '(?i)shadowcopy')
   OR (Exe =~ '(?i)wevtutil\.exe$' AND CommandLine =~ '(?i)(cl|clear-log) security')
   OR (Exe =~ '(?i)bcdedit\.exe$' AND CommandLine =~ '(?i)recoveryenabled no')

Remediation & Verification Script

# SafePay Defense: VPN/MFA posture verification and shadow copy protection audit
# Run elevated on domain controllers / VPN-adjacent management hosts

# 1. Identify accounts without recent password changes (stale creds are prime targets)
$staleDays = 365
Get-ADUser -Filter {Enabled -eq $true -and PasswordNeverExpires -eq $true} `
    -Properties PasswordLastSet, PasswordNeverExpires |
    Where-Object { $_.PasswordLastSet -lt (Get-Date).AddDays(-$staleDays) } |
    Select-Object SamAccountName, PasswordLastSet, PasswordNeverExpires |
    Export-Csv -Path ".\StaleCredentialAccounts.csv" -NoTypeInformation
Write-Host "[+] Stale credential report written to StaleCredentialAccounts.csv" -ForegroundColor Cyan

# 2. Verify shadow copies exist and VSS is healthy (post-intrusion recoverability check)
Write-Host "`n[+] Current shadow copies on this host:" -ForegroundColor Cyan
vssadmin list shadows
Get-WmiObject Win32_ShadowCopy | Select-Object DeviceObject, InstallDate, VolumeName

# 3. Audit for suspicious shadow copy deletion artifacts in recent event history
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} `
    -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'vssadmin.*delete shadows|wmic.*shadowcopy|wevtutil.*cl security' } |
    Select-Object TimeCreated, Message |
    Format-List

# 4. Restrict vssadmin usage via AppLocker/WDAC is recommended; at minimum, alert on it
# 5. Force password reset for any VPN-enabled group members flagged in step 1
$vpnGroup = "VPN-Users"   # Adjust to your VPN access group name
Get-ADGroupMember -Identity $vpnGroup -Recursive -ErrorAction SilentlyContinue |
    Where-Object { $_.objectClass -eq 'user' } |
    ForEach-Object {
        $u = Get-ADUser $_.SamAccountName -Properties PasswordLastSet
        if ($u.PasswordLastSet -lt (Get-Date).AddDays(-$staleDays)) {
            Write-Warning "STALE VPN CREDENTIAL: $($u.SamAccountName) — last set $($u.PasswordLastSet)"
        }
    }
Write-Host "`n[+] Audit complete. Escalate any hits to IR immediately." -ForegroundColor Green

Remediation — Priority Actions

Because SafePay's primary vector is valid credentials against remote access infrastructure, your remediation priorities are identity-centric, not patch-centric. Execute in this order:

1. Enforce phishing-resistant MFA on all remote access — this week. Every VPN gateway, SSL-VPN portal, and RDP pathway must require MFA. Prioritize FIDO2/passkeys or number-matching push; SMS and TOTP-only configurations remain vulnerable to AiTM phishing kits. Audit service accounts and legacy authentication exceptions — SafePay operators specifically hunt for unprotected accounts.

2. Hunt and reset compromised credentials.

• Force password resets for all VPN-enabled accounts with passwords older than 12 months.
• Cross-reference your user base against infostealer log marketplaces via your threat intel provider — SafePay's access often originates from credentials harvested by infostealers months earlier.
• Audit for accounts with PasswordNeverExpires flags and eliminate them for remote access users.

3. Reduce the attack surface at the edge.

• If VPN access isn't business-critical for a subnet or user population, remove it.
• Restrict VPN authentication to managed, compliant devices using certificate-based device checks.
• Never expose RDP (TCP 3389) directly to the internet. Place it behind VPN + MFA + gateway.

4. Protect recoverability.

• Deploy immutable, offline, or air-gapped backups — SafePay targets shadow copies specifically because attackers know most organizations' "backups" are actually local snapshots.
• Alert on any shadow copy deletion (the Sigma and KQL above). In a mature SOC, this single detection is one of the highest-fidelity ransomware tripwires available.

5. Prepare for double extortion, not just encryption.

• Map where your sensitive data lives and instrument egress monitoring. A 500 GB upload at 2 AM is your last detection opportunity before the leak site post.
• Pre-draft your regulatory notification workflows (HIPAA, state breach laws, GDPR if EU data is implicated) — with German and UK agencies involved in this advisory, SafePay's leak site publications carry cross-border regulatory consequences.

6. Review the full joint advisory. Consult the CISA Stop Ransomware page (cisa.gov/stopransomware) and the published SafePay advisory for authoritative IOCs and TTP mapping. Subscribe to CISA's advisory feed — when five agencies publish jointly, follow-on reporting and updated indicators typically arrive within days.

If You Suspect Compromise

1. Isolate affected VPN accounts and force revocation of active sessions — do not just reset passwords; kill tokens.
2. Preserve authentication logs from VPN concentrators before retention windows expire. These are frequently your only record of the initial access vector.
3. Check for data exfiltration indicators before assuming it's encryption-only. Double extortion means the data may already be gone.
4. Engage your IR retainer or a DFIR firm before rebuilding — premature reimaging destroys attribution evidence that law enforcement (including the FBI field office you should notify) will need.

The Bottom Line

SafePay's 600-victim count was not built on sophisticated exploits. It was built on a simple equation: internet-facing remote access + no MFA + stolen credentials = intrusion. The agencies behind this advisory are telling you exactly where to invest. Phishing-resistant MFA on every remote access path, aggressive credential hygiene, immutable backups, and pre-encryption detection on shadow copy deletion and data egress will defeat this exact attack chain — not just against SafePay, but against the entire class of ransomware operators running the same playbook.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub