Classification: TLP:CLEAR | Publication Date: 2026-10-31 | Source: ransomware.live leak-site monitoring (single-source for some listings — see Sourcing & Verification) | Nature of data: Unverified threat-actor claims

SAFEPAY Ransomware Gang: 9 New Leak-Site Listings in a Single Day

Executive Summary

On 2026-10-31, the SAFEPAY ransomware operation listed nine organizations on its dark web leak site in a single-day posting burst. The claimed victims span manufacturing, education, transportation, agriculture and food production, and miscellaneous commercial sectors, with geographic distribution across Ecuador, Taiwan, the United States, Peru, Japan, Argentina, Israel, and Mexico.

Every listing in this batch is a single-source observation — seen by one leak-site crawler only — and every listing is an unverified claim by a criminal actor. No organization named in this briefing has been confirmed breached by this data. This briefing exists so that defenders in the affected sectors can hunt for SAFEPAY's known tradecraft proactively, not to assert that any named organization has suffered an incident.

Organizations in education, manufacturing, and transportation should treat this posting wave as a sector-level warning: SAFEPAY's public leak activity indicates an active campaign tempo, and its known initial-access tradecraft (exposed remote services, credential attacks, phishing) maps directly to the exposure of mid-market organizations in these verticals.

Sourcing & Verification

• Corroboration status: 0 of 9 listings in this batch were independently observed by a second leak-site crawler. All 9 appear on a single source (ransomware.live) only. Single-source status means we cannot yet confirm the posting itself was independently witnessed — let alone that any underlying intrusion occurred.
• What a listing means: Inclusion in this briefing reflects a threat actor's claim, published on infrastructure the actor controls. It is not confirmation of a breach. Leak-site postings are accusations made by criminals for extortion leverage and have historically included exaggerated, recycled, or fabricated claims.
• Denials and silence: A named organization may dispute the listing, and a denial is likewise not proof the claim is false. Disclosure obligations vary by jurisdiction and sector, and not every incident is reportable — so neither silence nor denial settles the question. Only the organization itself or its regulator can confirm an incident.
• Corrections: Security Arsenal will publish corrections to this briefing if listings are removed, retracted, or disputed. We welcome contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — SAFEPAY

SAFEPAY emerged in the ransomware ecosystem as a data-theft-first extortion operation. Key characteristics observed across its activity:

• Aliases / branding: Operates primarily under the "SAFEPAY" name on its dedicated leak site. No widely attributed rebrand is confirmed in our tracking; analysts should treat alias claims in open reporting cautiously.
• Operating model: Assessed as a closed or semi-closed group rather than a broadly franchised RaaS. The victim cadence and consistent leak-site formatting suggest a tight operator core, though affiliate-style initial access procurement (purchased access from IABs) cannot be ruled out.
• Ransom behavior: Demands are typically scaled to perceived victim revenue, with negotiation conducted via a TOR-hosted chat portal referenced in the ransom note. Double extortion — data theft plus encryption threat — is the standard play; some postings threaten data release without evidence encryption ever occurred.
• Initial access methods (typical): Exploitation of exposed remote services (VPN concentrators, firewalls, RDP), valid-account abuse from credential dumps or brute force, and phishing-delivered loaders. Access broker procurement is consistent with the speed of single-day multi-victim posting waves like this one.
• Dwell time: Observed dwell time in comparable closed-group campaigns ranges from days to roughly two weeks between initial access and leak-site posting, though posting date is not detonation date — claims often appear before, after, or entirely without encryption.
• Tooling: Commodity post-exploitation stack typical of mid-tier crews: Cobalt Strike or equivalent C2, PsExec/WMI for lateral movement, Rclone or similar for exfiltration to cloud storage, and Volume Shadow Copy deletion prior to encryption.

Current Campaign Analysis

Claimed victim set (2026-10-31)

SAFEPAY has listed / claims to have compromised the following organizations on its leak site. All are single-source, unverified claims:

Sector concentration

The batch skews toward mid-market, operationally dependent organizations: two education institutions (JP, MX), one manufacturer (TW), one transportation firm (US), and one agriculture/food producer (TW), plus several uncategorized commercial entities. This is consistent with SAFEPAY's historical profile — organizations with uptime pressure, lean security staffing, and high willingness-to-pay relative to revenue. The "Other"/"Not Found" entries suggest the gang (or the crawler) could not cleanly categorize smaller victims, itself a hallmark of opportunistic, access-broker-fed operations rather than deliberate sector campaigns.

Geographic concentration

Eight countries across Latin America (EC, PE, AR, MX), East Asia (TW ×2, JP), North America (US), and the Middle East (IL). The Latin America weighting (4 of 9) plus two Taiwan listings is notable and matches a pattern of targeting regions where breach-disclosure pressure is lower and incident response maturity is variable.

Victim profile

Based on the sectors claimed, the typical revenue band is small-to-mid enterprise: private universities, regional trucking and distribution firms, specialty manufacturers, and agricultural producers. These are organizations with meaningful cyber-insurance coverage but limited 24×7 SOC coverage — precisely the profile double-extortion groups prefer.

Posting tempo

Nine postings in a single day represents an escalation burst, not a steady-state cadence. Burst posting frequently indicates one of three things: (1) a batch of access purchased from a broker was operationalized at once; (2) a negotiation deadline dump, where stalled negotiations were published simultaneously for leverage; or (3) credibility-building by a crew trying to appear busier than it is. Single-source status on all nine leans toward caution — verify the postings persist before treating tempo as a trend.

CVE linkage — hypothesis only

We have no evidence tying any named listing to a specific CVE. However, SAFEPAY's known reliance on exposed perimeter services makes the following CISA KEV entries (confirmed ransomware use) relevant sector-level exposure hypotheses for defenders in the targeted verticals:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Perimeter-VPN auth bypass is a classic entry for this profile of gang. Patch/verify immediately if Check Point gateways are internet-facing.
• CVE-2026-20316 — Cisco Secure FMC hard-coded password. Management-plane compromise enables policy tampering and quiet ingress.
• CVE-2026-59310 — VMware vCenter path traversal. Relevant post-entry: vCenter compromise enables mass hypervisor encryption, the highest-impact detonation scenario.
• CVE-2026-63077 — JetBrains TeamCity deserialization. CI/CD servers are attractive lateral movement and supply-chain pivots, particularly for manufacturing and technology victims.
• CVE-2026-48027 — Nx Console embedded malicious code. Developer-workstation supply-chain exposure; relevant to phishing/dev-tooling delivery chains.

Treat these as patch-priority inputs, not attribution.

Detection Engineering

The following detections target SAFEPAY's documented tradecraft pattern: perimeter/valid-account entry → Cobalt Strike-style C2 → PsExec/WMI lateral movement → data staging (Rclone/7-Zip) → shadow copy deletion → encryption.

---
title: SAFEPAY - Suspected Initial Access via VPN or RDP Brute Force Followed by Success
id: 9a1f3c2e-5b7d-4e1a-8c6f-2d9e4b7a1f01
status: experimental
description: Detects a burst of failed external authentication attempts against VPN/RDP followed by a successful logon from the same source — consistent with SAFEPAY-style valid-account initial access.
author: Security Arsenal Threat Intel
references:
    - https://securityarsenal.com/darkside
logsource:
    category: authentication
    product: windows
detection:
    selection_failed:
        EventID:
            - 4625
            - 529
            - 530
    filter_rdp_vpn:
        LogonType:
            - 3
            - 10
    condition: selection_failed and filter_rdp_vpn | count() by SourceIp > 20
fields:
    - SourceIp
    - TargetUserName
falsepositives:
    - Legitimate password-spray misconfiguration by internal scanners
    - Users with expired passwords retrying
level: high
tags:
    - attack.initial_access
    - attack.t1110
    - attack.t1078
---
title: SAFEPAY - PsExec or WMI Remote Service Creation for Lateral Movement
id: 7c2e8d1f-3a4b-4c9d-b6e5-1f8a2c4d9e02
status: experimental
description: Detects remote service installation (PsExec-style) and WMI process creation patterns used by SAFEPAY operators for lateral movement prior to staging and encryption.
author: Security Arsenal Threat Intel
date: 2026/10/31
references:
    - https://securityarsenal.com/darkside
logsource:
    product: windows
    service: system
detection:
    selection_service:
        EventID: 7045
        ServiceFileName|contains:
            - 'PSEXESVC'
            - '\Admin$\'
            - '\IPC$\'
            - 'paexec'
            - 'csexec'
    selection_service_2:
        EventID: 7045
        ServiceFileName|contains:
            - 'cmd.exe /c'
            - 'powershell.exe -enc'
            - 'powershell.exe -e '
    condition: 1 of selection_service*
fields:
    - ServiceName
    - ServiceFileName
    - ComputerName
falsepositives:
    - Legitimate administrative tooling (SCCM, PDQ Deploy) — baseline and whitelist known admin service names
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1569.002
    - attack.t1047
---
title: SAFEPAY - Pre-Encryption Staging - Shadow Copy Deletion and Bulk Archive Exfil Tools
id: 4d8b1e6a-9c3f-4a2d-b7e1-6f5c8a3d2e03
status: experimental
description: Detects Volume Shadow Copy deletion and execution of data-staging/archiving utilities (rclone, 7z, winrar with suspicious args) commonly used by SAFEPAY before detonation or leak posting.
author: Security Arsenal Threat Intel
date: 2026/10/31
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        - Image|endswith: '\vssadmin.exe'
          CommandLine|contains:
            - 'delete shadows'
            - 'resize shadowstorage'
        - Image|endswith: '\wmic.exe'
          CommandLine|contains: 'shadowcopy delete'
        - Image|endswith: '\bcdedit.exe'
          CommandLine|contains: 'recoveryenabled no'
    selection_stage:
        Image|endswith:
            - '\rclone.exe'
            - '\7z.exe'
            - '\7za.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - 'a -v'
            - 'copy '
            - 'sync '
            - 'mega'
            - 'dropbox'
            - ' --config'
    condition: 1 of selection_*
fields:
    - Image
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - Backup administrators running shadow storage maintenance
    - Legitimate Rclone usage by IT — whitelist known service accounts and paths
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.collection
    - attack.t1560
    - attack.exfiltration
    - attack.t1567

// SAFEPAY hunt: lateral movement + pre-ransomware staging chain
// Sentinel — looks for remote service creation or PsExec-style execution
// followed within 2 hours by shadow-copy deletion or archive/exfil tooling
// on the same host. Tune the 20-failed-logon threshold to your baseline.

let Lookback = 7d;
let StagingWindow = 2h;

let LateralMove =
    union (
        SecurityEvent
        | where TimeGenerated > ago(Lookback)
        | where EventID == 7045
        | where ServiceFileName has_any ("PSEXESVC", "\\Admin$\\", "paexec", "csexec")
        | extend Host = Computer, LMTime = TimeGenerated, Indicator = strcat("ServiceInstall: ", ServiceName)
    ), (
        DeviceProcessEvents
        | where TimeGenerated > ago(Lookback)
        | where FileName =~ "wmic.exe" and ProcessCommandLine has "process call create"
        | extend Host = DeviceName, LMTime = TimeGenerated, Indicator = strcat("WMI remote exec: ", ProcessCommandLine)
    );

let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where
        (ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no"))
        or (FileName has_any ("rclone.exe", "7z.exe", "7za.exe", "rar.exe")
            and ProcessCommandLine has_any (" copy ", " sync ", " a -v", "mega", "dropbox"))
    | extend Host = DeviceName, StageTime = TimeGenerated, StageIndicator = strcat(FileName, " | ", ProcessCommandLine);

LateralMove
| join kind=inner Staging on Host
| where StageTime between (LMTime .. (LMTime + StagingWindow))
| project Host, LMTime, Indicator, StageTime, StageIndicator, InitiatingProcessAccountName
| sort by LMTime desc;

# SAFEPAY rapid triage script — run on suspected hosts or via remote sweep
# Checks: recently created scheduled tasks (7d), shadow copy state,
# RDP exposure, and suspicious new local admins.

$report = @()
$cutoff = (Get-Date).AddDays(-7)

Write-Host "=== [1] Scheduled tasks created in last 7 days ===" -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
    Select-Object TaskName, TaskPath, Date
$tasks | Format-Table -AutoSize
$report += $tasks

Write-Host "=== [2] Volume Shadow Copy status ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    Write-Host "WARNING: No shadow copies found — possible vssadmin deletion (T1490)" -ForegroundColor Red
    $report += [pscustomobject]@{ Finding = "NO_SHADOW_COPIES"; Time = (Get-Date) }
} else {
    $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize
}

Write-Host "=== [3] RDP exposure check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication
Write-Host "RDP Enabled: $rdpEnabled | Port: $rdpPort | NLA: $nla"
if ($rdpEnabled -and $nla -eq 0) {
    Write-Host "WARNING: RDP enabled WITHOUT NLA — brute-force friendly (T1110/T1078)" -ForegroundColor Red
}

Write-Host "=== [4] Local Administrators — flag unexpected members ===" -ForegroundColor Cyan
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue |
    Select-Object Name, ObjectClass, PrincipalSource | Format-Table -AutoSize

Write-Host "=== [5] Failed logons (4625) top source IPs, last 24h ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    ForEach-Object { ([xml]$_.ToXml()).Event.EventData.Data | Where-Object Name -eq 'IpAddress' | Select-Object -ExpandProperty '#text' } |
    Group-Object | Sort-Object Count -Descending | Select-Object -First 10 Count, Name | Format-Table -AutoSize

Write-Host "`nTriage complete. Escalate any T1490 (shadow copy) or mass-4625 findings to IR immediately." -ForegroundColor Green

Incident Response Priorities

T-minus detection checklist — before encryption fires

SAFEPAY's playbook leaves a recognizable pre-detonation window. Alert immediately on any of:

1. Shadow copy manipulation — vssadmin delete shadows, wmic shadowcopy delete, bcdedit ... recoveryenabled no. This is the highest-fidelity pre-encryption signal.
2. Mass failed logons followed by success on VPN/RDP from a single external source.
3. New services installed via ADMIN$/PsExec across multiple hosts in a short window.
4. Rclone/7z/WinRAR execution by non-IT accounts, especially with cloud-storage config flags.
5. Unusual outbound volume to consumer cloud storage or unfamiliar VPS ASNs during off-hours.
6. Cobalt Strike-style artifacts: named pipes (\\.\pipe\MSSE-*, \\.\pipe\postex_*), service executables with 8-character random names in %TEMP% or C:\ProgramData.

Assets this gang's profile prioritizes for exfiltration

• Finance/HR data (payroll, tax IDs, banking details) — highest extortion leverage.
• Legal and contract repositories.
• Student/patient/constituent PII in education and public-sector-adjacent victims.
• Email archives of executive leadership (used to validate the breach and pressure negotiation).
• Backup catalogs and credentials — often enumerated and destroyed to force payment.

Containment actions, ordered by urgency

1. Isolate, don't power off — network-quarantine affected hosts to preserve memory artifacts for forensics.
2. Disable compromised identities — force-reset any account observed in suspicious logons; revoke VPN sessions and tokens globally.
3. Block C2 and exfil egress — sinkhole observed C2 domains/IPs; restrict outbound to approved destinations at the perimeter.
4. Protect backups — take backup infrastructure offline or immutable-verify it; assume the operator has enumerated it.
5. Segment — emergency ACLs between user VLANs and server/backup/hypervisor management planes.
6. Preserve evidence — capture volatile data, export Security/System event logs and EDR telemetry before rotation.
7. Engage counsel/IR retainer early — disclosure obligations vary by jurisdiction; do not treat a leak-site claim as a confirmed breach without internal verification.

Hardening Recommendations

Immediate (24 hours)

• Patch KEV perimeter exposure: Verify remediation of CVE-2026-50751 (Check Point) and CVE-2026-20316 (Cisco FMC) on all internet-facing devices; if unpatched, restrict management interfaces to allow-listed admin IPs now.
• MFA everywhere remote: Enforce phishing-resistant MFA on VPN, RDP gateways, and remote management. Valid-account abuse is this gang's front door.
• Kill direct internet RDP: Confirm no host exposes TCP/3389 (or custom RDP ports) publicly; enforce NLA.
• Block staging tooling: Application-control deny or alert on rclone, 7z, rar, and PsExec for non-admin accounts.
• Alert on T1490: Deploy the shadow-copy deletion detection above to all Windows endpoints and servers.
• vCenter audit: Inventory vCenter versions against CVE-2026-59310; restrict vCenter management to a dedicated, monitored segment.

Short-term (2 weeks)

• Tiered administration: Separate hypervisor, backup, and identity admin planes with dedicated PAWs; no shared credentials across tiers.
• Immutable/offline backups: Move at least one backup copy to immutable or air-gapped storage with a tested restore runbook.
• Egress filtering: Default-deny outbound for servers; alert on consumer cloud-storage destinations.
• CI/CD hardening: Patch TeamCity (CVE-2026-63077), lock build agents away from production credentials, and audit developer tooling supply chain (CVE-2026-48027 class of risk).
• EDR coverage gap-closure: Prioritize the sectors this gang targets — education, manufacturing, logistics, agriculture — where server and legacy-OT-adjacent hosts often lack agents.
• Detection-as-code: Deploy the Sigma rules in this briefing through your SIEM pipeline and tune false positives against your admin tooling baseline.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub