SAFEPAY Ransomware Gang: 8 New Leak-Site Victims — Sector/Geo Targeting Analysis, CVE Access Paths & Detection Rules | Security Arsenal

Reporting date: 2026-09-20
Source basis: Victim telemetry and KEV mappings provided for this briefing from ransomware.live / CISA KEV-style feeds. Treat victim claims as adversary-asserted until independently verified through IR, customer notification, or third-party confirmation.

Threat Actor Profile — SAFEPAY

Aliases / naming: SAFEPAY, SafePay ransomware, SafePay leak site. Public reporting has associated the brand with post-LockBit ecosystem churn and possible operator overlap with other closed/RaaS-adjacent crews; attribution confidence should remain moderate unless infrastructure, payload, or negotiation artifacts are available.
Operating model: Present as a ransomware brand running a dedicated leak site and double-extortion workflow. The public-facing model looks closer to a closed or tightly controlled affiliate program than an open RaaS portal: limited recruiting chatter, centralized victim posting, standardized negotiation language, and rapid publication after alleged intrusion.
Typical ransom behavior: Double extortion — file encryption plus threatened publication of stolen data. Demands are commonly scaled to perceived victim revenue, cyber-insurance posture, regulatory exposure, and sensitivity of exfiltrated data. Healthcare and professional services victims are often pressured around confidentiality obligations; manufacturers around downtime and supply-chain commitments.
Known/suspected initial access: Prioritize externally exposed remote access and management planes: VPN concentrators and firewalls, vulnerable remote monitoring and management tools, exposed RDP, phished credentials followed by token/session reuse, and virtualization management planes. The KEV set below is consistent with edge-device compromise, RMM abuse, and vCenter/backup-adjacent compromise rather than a single signature loader.
Double extortion approach: Victim name/domain, sector/country tags, countdown or proof-of-leak posting, sample data trees, and staged release after negotiation failure. Expect archive naming that mimics legitimate business data and selective leakage designed to maximize legal and reputational pressure.
Dwell time: For this class of operator, assume days-to-weeks from access to encryption when edge/RMM access is used, but compress to hours if valid domain admin credentials, vCenter control, or backup console access is obtained. Detection should focus on the pre-encryption window rather than payload execution.

Current Campaign Analysis

Victim cadence: 8 victims in the last 100 postings, all listed as published 2026-09-15: marlinhvac.com, neumerkel-gmbh.de, triniticaring.org, laconcepcion.com.mx, meterex.com, stoecklin-kuechen.ch, ryomo.co.jp, ara-lyss.ch.
Sectors targeted: Manufacturing 2/8, Retail & E-Commerce 2/8, Healthcare 1/8, Technology 1/8, Professional Services 1/8, Not Found 1/8. The mix is consistent with opportunistic edge-access compromise followed by monetization triage, not purely sector-specific intrusion.
Geographic concentration: US 2, DE 2, CH 2, MX 1, JP 1. No single-country cluster; instead a distributed SMB/mid-market footprint across North America, Europe, and Japan. Language and legal-pressure tactics likely vary by region.
Victim profile: Mostly small-to-mid enterprises and regional business units: HVAC/manufacturing services, German Mittelstand manufacturing, US healthcare/community care, Mexican e-commerce/retail, German technology, Swiss kitchen retail and professional services, Japanese organization with unclassified sector. Revenue likely ranges from low eight figures to mid nine figures; healthcare and manufacturing carry outsized operational and regulatory leverage.
Posting frequency / escalation: One-day bulk publication of eight victims suggests either a batch disclosure after parallel intrusions, a negotiated-deadline clearing event, or deliberate pressure timing. Escalation indicators to watch: reposting with partial file trees, adding samples after 48-96 hours, translating extortion notes, and naming downstream customers or patients.
CVE linkage as initial access vectors: Do not assert causality without telemetry, but the listed KEVs map cleanly to SAFEPAY-style access paths: CVE-2026-50751 Check Point IKEv1 improper authentication and CVE-2026-20316 Cisco FMC hard-coded password point to perimeter/control-plane takeover; CVE-2024-1708 ConnectWise ScreenConnect path traversal/RCE points to RMM abuse common in ransomware hands-on-keyboard operations; CVE-2026-59310 VMware vCenter path traversal points to hypervisor/backup blast-radius expansion; CVE-2026-48027 Nx Console embedded malicious code is a developer/CI supply-chain path that can yield credentials and build-host access. Prioritize exploit-path validation over payload-name detection.

Detection Engineering

YAML

---
title: SAFEPAY-Style Edge or RDP Initial Access Followed by Logon Success
id: 7b0d2f6a-1f3c-4c6a-9d7b-safepay001
status: experimental
description: Detects repeated remote logon failures from the same source followed by successful interactive or network logon, consistent with VPN/RDP credential attacks used by ransomware operators.
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Detection Engineering
date: 2026/09/20
logsource:
  product: windows
  service: security
detection:
  sel_fail:
    EventID: 4625
  sel_success:
    EventID: 4624
    LogonType: 3|10
  condition: sel_fail and sel_success
  timeframe: 15m
level: high
tags:
  - attack.initial_access
  - attack.t1110
  - attack.t1078
falsepositives:
  - Vulnerability scanners
  - Misconfigured service accounts
---
title: SAFEPAY-Style Lateral Movement via PsExec WMI or Remote Service Creation
id: 9a4ce2bd-5a2b-44e9-a5d1-safepay002
status: experimental
description: Detects remote execution tooling frequently used before ransomware detonation, including PsExec-style service binaries, WMI process creation, and suspicious remote service installation.
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Detection Engineering
date: 2026/09/20
logsource:
  category: process_creation
  product: windows
detection:
  sel_img:
    Image|endswith:
      - 'psexec.exe'
      - 'psexesvc.exe'
      - 'wmic.exe'
      - 'wmiprvse.exe'
      - 'powershell.exe'
      - 'cmd.exe'
  sel_cli:
    CommandLine|contains:
      - 'PSEXESVC'
      - 'CreateProcessAsUser'
      - 'Win32_Process'
      - 'cmd.exe /c'
      - 'sc.exe'
      - 'New-Service'
      - 'Invoke-Command'
      - 'Enter-PSSession'
  condition: sel_img and sel_cli
level: high
tags:
  - attack.lateral_movement
  - attack.execution
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
falsepositives:
  - Administrative software deployment
  - EDR response actions
---
title: Pre-Ransomware Staging Shadow Copy Deletion and Archive Creation
id: 4f77a1c8-0c94-4f0f-b221-safepay003
status: experimental
description: Detects pre-encryption behaviors: shadow copy deletion, backup tampering, mass archive creation, and suspicious compression utilities in user or server data paths.
references:
  - https://securityarsenal.com/darkside
author: Security Arsenal Detection Engineering
date: 2026/09/20
logsource:
  category: process_creation
  product: windows
detection:
  sel_shadow:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wbadmin delete catalog'
      - 'bcdedit'
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  sel_archive:
    Image|endswith:
      - '7z.exe'
      - 'rar.exe'
      - 'winrar.exe'
      - 'tar.exe'
      - 'curl.exe'
      - 'rclone.exe'
    CommandLine|contains:
      - ' a '
      - '.zip'
      - '.7z'
      - '.rar'
      - ' exfil'
      - 'backup'
  condition: sel_shadow or sel_archive
level: critical
tags:
  - attack.impact
  - attack.exfiltration
  - attack.t1490
  - attack.t1560.001
  - attack.t1567
falsepositives:
  - Backup administrators
  - Legitimate archive jobs

KQL — Microsoft Sentinel / Defender

let lookback = 14d;
let susp_tools = dynamic(['psexec.exe','psexesvc.exe','wmic.exe','rclone.exe','7z.exe','rar.exe','winscp.exe','curl.exe','powershell.exe','cmd.exe']);
let staging_terms = dynamic(['backup','confidential','finance','hr','patient','payroll','vpn','rdp','shadow','vssadmin','wbadmin','bcdedit','exfil']);
union isfuzzy=true
(SecurityEvent
 | where TimeGenerated >= ago(lookback)
 | where EventID in (4624,4625,4648,4672,4697,7045)
 | extend Indicator = strcat(EventID,'|',Account,'|',IpAddress,'|',WorkstationName,'|',ProcessName)
 | summarize Failed4625=countif(EventID==4625), Success4624=countif(EventID==4624), ExplicitCreds=countif(EventID==4648), AdminAssigned=countif(EventID==4672), ServiceCreated=countif(EventID in (4697,7045)) by Computer, Account, IpAddress, bin(TimeGenerated,1h)
 | where Failed4625 >= 20 and (Success4624 >= 1 or ExplicitCreds >= 1 or ServiceCreated >= 1)
 | extend HuntNote='RDP/VPN brute force followed by success or service creation'),
(DeviceProcessEvents
 | where TimeGenerated >= ago(lookback)
 | where FileName in~ (susp_tools) or ProcessCommandLine has_any (staging_terms)
 | where ProcessCommandLine has_any ('vssadmin','wbadmin','bcdedit','PSEXESVC','Win32_Process','rclone','7z a','rar a','scp','curl')
 | summarize ProcessHits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Commands=make_set(ProcessCommandLine,20) by DeviceName, AccountName, InitiatingProcessFileName, bin(TimeGenerated,1h)
 | where ProcessHits >= 3
 | extend HuntNote='Pre-ransom staging, shadow tamper, archive/exfil, or remote execution'),
(DeviceNetworkEvents
 | where TimeGenerated >= ago(lookback)
 | where RemotePort in (3389,5985,5986,22,445,443,8443) or RemoteUrl has_any ('mega.nz','dropbox','transfer.sh','file.io','pastebin')
 | summarize NetHits=count(), RemoteIPs=make_set(RemoteIP,25), Ports=make_set(RemotePort,25) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(TimeGenerated,1h)
 | where NetHits >= 50 or array_length(RemoteIPs) >= 10
 | extend HuntNote='High fan-out remote access or exfil-like egress')
| sort by TimeGenerated desc

PowerShell

# SAFEPAY rapid pre-ransom assessment: run elevated on suspect servers and a domain controller.
$since = (Get-Date).AddDays(-7)
$report = [ordered]@{}

$report.RDP_NLA_Required = try { (Get-CimInstance -Namespace root/cimv2/TerminalServices -Class Win32_TerminalServiceSetting -ErrorAction Stop).UserAuthenticationRequired } catch { 'query-failed' }
$report.RDP_Firewall_Rules = Get-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyContinue | Select-Object DisplayName,Enabled,Profile,Action
$report.New_Scheduled_Tasks_7d = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Date -ge $since -or ($_.Triggers.StartBoundary -match [regex]::Escape($since.ToString('yyyy-MM-dd'))) } | Select-Object TaskName,TaskPath,State,Author,Date
$report.New_Local_Admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name,ObjectClass,PrincipalSource
$report.ShadowCopies = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue | Select-Object ID,DeviceObject,InstallDate,Count
$report.Suspicious_Services_7d = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object { $_.PathName -match 'psexesvc|paexec|remcom|rclone|7z|winrar|appdata|programdata|temp' } | Select-Object Name,DisplayName,State,StartMode,PathName,StartName
$report.Logon_Failures_Top_Sources = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$since} -ErrorAction SilentlyContinue | Group-Object { $_.Properties[19].Value } | Sort-Object Count -Descending | Select-Object -First 15 Count,Name
$report.Privileged_Logon_Recent = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672; StartTime=$since} -ErrorAction SilentlyContinue | Select-Object -First 50 TimeCreated,Id,Message
$report.Recent_Writable_Archives = Get-ChildItem -Path C:/Users,C:/ProgramData -Include *.zip,*.7z,*.rar,*.tar,*.gz -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge $since -and $_.Length -gt 50MB } | Select-Object FullName,Length,LastWriteTime

$report | ConvertTo-Json -Depth 5

Incident Response Priorities

T-minus detection checklist — before encryption fires: new or re-enabled edge VPN accounts; impossible travel followed by successful 4624 type 3/10; EventID 4648 explicit credential use; 4672 special privileges assigned outside change windows; 4697/7045 service creation; PsExec-like service names in ADMIN$ or IPC$ contexts; WMI Win32_Process creation against many hosts within minutes; enumeration of shares, backup consoles, vCenter, NAS, and AD; bulk read of finance/HR/patient/project folders; 7z/RAR/rclone/curl execution on servers; vssadmin/wbadmin/bcdedit tampering; disabling EDR via approved-looking management tooling; sudden egress to rare ASNs or file-sharing domains.
Critical assets historically prioritized for exfiltration: backup catalogs and snapshots, hypervisor/vCenter inventory, AD and identity stores, VPN/firewall configurations, RMM agent and script repositories, finance and payroll exports, HR files, legal/contracts, source code/build secrets, EHR or patient-adjacent exports for healthcare victims, CAD/PLC/supply-chain documents for manufacturers, customer databases for retail/e-commerce.
Containment actions ordered by urgency: 1) Isolate affected subnets/hosts at switch or EDR network containment while preserving memory where feasible. 2) Disable suspected compromised accounts and force enterprise-wide credential reset for interactive admins, VPN users, service accounts, vCenter, backup, and RMM. 3) Block edge access paths: emergency patch or virtual-patch Check Point/Cisco FMC/ConnectWise/vCenter exposures; restrict management interfaces to allowlisted jump hosts. 4) Kill persistence: remove rogue services, scheduled tasks, RMM agents, run keys, local admins, and OAuth/app grants. 5) Protect crown jewels: offline/immutable backup verification, snapshot locks, credential rotation for backup and storage, deny delete on backup repositories. 6) Scope blast radius with triage timeline: first successful logon, first admin, first share access, first archive, first shadow tamper. 7) Engage legal/comms early for healthcare, EU/CH/DE/JP privacy, and contractual notification duties. 8) Preserve volatile evidence before aggressive cleanup: memory, Security/System logs, VPN concentrator logs, firewall FMC events, RMM audit trails, vCenter events, proxy/DNS egress.

Hardening Recommendations

Immediate 0-24h: Patch or mitigate CVE-2026-50751, CVE-2026-20316, CVE-2026-59310, CVE-2024-1708 and validate no internet exposure remains for management portals; disable legacy IKEv1 where feasible; enforce phishing-resistant MFA for VPN, RMM, vCenter, email, and SSO; require NLA and restrict RDP to jump boxes; remove ScreenConnect/any unmanaged RMM not explicitly approved; rotate credentials exposed to VPN/RMM/EDR/backup consoles; enable tamper protection and block EDR uninstall without dual approval; alert on vssadmin/wbadmin/bcdedit and mass 7z/RAR creation; block egress to consumer file-sharing for servers; snapshot critical servers and verify immutable backup isolation.
Short-term 2 weeks: Segment identity, backup, hypervisor, RMM, and production VLANs with deny-by-default east-west rules; eliminate standing domain admin and implement tiered admin with PAW/jump hosts; deploy just-in-time admin and LAPS; centralize logs for VPN, firewall, FMC, RMM, AD, vCenter, EDR, DNS, proxy, and cloud IdP into Sentinel with retention sufficient for 90-180 day hunts; create detection-as-code pipelines for the Sigma/KQL above; enforce application control on servers for compression and remote-exec tools; require code-signing and provenance checks for developer extensions and CI plugins after Nx Console-style supply-chain risk; run tabletop exercises for manufacturing downtime, healthcare patient safety, and multi-jurisdiction breach notification.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

SAFEPAY Ransomware Gang: 8 New Leak-Site Victims — Sector/Geo Targeting Analysis, CVE Access Paths & Detection Rules