SAFEPAY Ransomware: Global Manufacturing & Tech Targeted — Critical Vulnerability Exploitation Alert

Date: 2026-08-04 Source: Dark Web Leak Site Monitoring Author: Security Arsenal Intelligence Unit

Threat Actor Profile — SAFEPAY

Aliases & Structure: SAFEPAY operates as a Ransomware-as-a-Service (RaaS) entity, leveraging an affiliate network to conduct initial access and operations while the core team maintains the encryption payload and leak site infrastructure.

Modus Operandi:

• Ransom Demands: Typically range from $500,000 to $5 million USD, varying based on victim revenue and perceived data value.
• Initial Access: Historically favors perimeter device exploitation (VPN/Firewall) and compromised remote management tools (RMM). Recent intelligence indicates a heavy pivot to exploiting CVEs in edge appliances.
• Extortion Model: Strict double extortion. Victims' data is posted to the .onion site if payment is not received within the allocated timeline (usually 3-7 days post-deadline).
• Dwell Time: Short to moderate. Analysis of recent victimology suggests an average dwell time of 3–5 days between initial breach and encryption detonation, indicating a "smash-and-grab" philosophy prioritizing speed over stealth.

Current Campaign Analysis

Sector Targeting: The latest posting wave (9 victims on 2026-08-03) demonstrates a distinct pivot toward the Manufacturing sector (44% of victims), alongside continued pressure on Professional Services and Technology.

• High-Value Targets: naskdoorinc.com, simonrack.com, southshorerecycling.com, cpu-ag.com
• Secondary Targets: pradotuylaw.com (Legal), new-point.it (Tech)

Geographic Concentration: While SAFEPAY maintains global reach, this specific campaign shows heavy concentration in the United States (44% of victims), followed by Germany, Spain, Italy, Japan, and Israel.

Victim Profile: Targets are mid-to-large market enterprises. The inclusion of azn.co.jp and cpu-ag.com suggests the group possesses the capability to bypass complex, multi-regional network defenses.

Observed Posting Frequency: A mass-uploading event occurred on 2026-08-03. This "bulk" posting is often a tactic used to overwhelm security teams and pressure victims via peer-shaming on the leak site.

Initial Access Vectors & CVE Correlation: Based on the CISA KEV list associated with this group's recent activity:

1. CVE-2024-1708 (ConnectWise ScreenConnect): Highly likely used for access against Technology and Professional Services victims (new-point.it, pradotuylaw.com).
2. CVE-2026-50751 (Check Point Security Gateway): A critical vector for the Manufacturing victims, likely bypassing perimeter VPNs to establish a foothold.
3. CVE-2026-20131 (Cisco Secure Firewall FMC): Exploitation allows for the disabling of logging or rule modification, facilitating the lateral movement observed prior to encryption.

Detection Engineering

SIGMA Rules

---
title: Potential ConnectWise ScreenConnect Authentication Bypass
description: Detects potential exploitation of CVE-2024-1708 involving suspicious authentication paths or path traversal in ScreenConnect logs.
status: experimental
date: 2026/08/04
author: Security Arsenal
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5140|5145
    ShareName|contains: 'ScreenConnect'
    RelativeTargetName|contains: '..\'
  condition: selection
falsepositives:
  - Misconfigured log paths
level: critical
tags:
  - cve-2024-1708
  - ransomware
  - safepay
  - initial-access
---
title: Check Point VPN IKEv1 Anomalous Login
description: Detects exploitation attempts of CVE-2026-50751 via IKEv1 key exchange anomalies or unexpected successful authentications on legacy protocols.
status: experimental
date: 2026/08/04
author: Security Arsenal
logsource:
  product: firewall
detection:
  selection:
    dst_port: 500
    protocol: 'IKE'
    ike_version: '1'
    action: 'accept'
  condition: selection
falsepositives:
  - Legacy VPN configurations
level: high
tags:
  - cve-2026-50751
  - safepay
  - evasion
---
title: PsExec Lateral Movement Ransomware Pattern
description: Detects the use of PsExec for lateral movement, a common SAFEPAY TTP for distributing the payload before encryption.
status: experimental
date: 2026/08/04
author: Security Arsenal
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: 'IPC$'
    RelativeTargetName|startswith: 'PSEXESVC'
  condition: selection
falsepositives:
  - Legitimate admin tasks
level: high
tags:
  - attack.lateral_movement
  - safepay
  - execution

Microsoft Sentinel KQL Hunt

// Hunt for lateral movement and staging indicative of SAFEPAY pre-encryption
DeviceProcessEvents 
| where Timestamp > ago(7d) 
| where FileName in~ ("psexec.exe", "psexec64.exe", "wmic.exe", "powershell.exe") 
| where ProcessCommandLine has_any ("-accepteula", "process call create", "Invoke-Expression", "EncryptedData") 
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "winword.exe") 
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName 
| order by Timestamp desc

Rapid Response PowerShell Script

<#
.SYNOPSIS
    SAFEPAY Rapid Response - Indicators of Compromise Check
.DESCRIPTION
    Checks for suspicious scheduled tasks (persistence), RDP exposure, and recent mass file modifications (staging).
#>

Write-Host "[+] Checking for suspicious Scheduled Tasks created in last 7 days..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-7) -and 
    $_.Author -notmatch "Microsoft|Microsoft Corporation" -and
    $_.TaskName -notmatch "UpdateTask|FlashPlayer|GoogleUpdate"
} | Select-Object TaskName, Author, Date, Actions | Format-Table -AutoSize

Write-Host "[+] Checking for recent VSS Shadow Copy deletions (Ransomware prep)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7036; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue | 
Where-Object {$_.Message -like '*stopped*' -and $_.Message -like '*Volume Shadow Copy*'} | 
Select-Object TimeCreated, Message

Write-Host "[+] Enumerating RDP Users (Check for unknown accounts)..." -ForegroundColor Cyan
query user

Write-Host "[+] Searching for mass file encryption patterns (Extension changes)..." -ForegroundColor Cyan
# Note: This is a basic check; in a live incident, look for specific SAFEPAY extensions if known
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue -Include *.safepay, *.encrypted, *.locked | Select-Object FullName, LastWriteTime | Measure-Object


---

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption):

1. RMM Audit: Immediately audit logs for ConnectWise ScreenConnect (CVE-2024-1708) and AnyDesk/TeamViewer anomalies.
2. Perimeter Logs: Review Check Point and Cisco FMC logs for unauthorized IKEv1 sessions or deserialization attempts.
3. Account Activity: Look for service account creation or modification at odd hours (often used for lateral movement).

Critical Assets for Exfiltration: Based on historical SAFEPAY behavior, prioritize protection of:

• CAD/PLM files (Manufacturing targets)
• Client Legal Dossiers (Professional Services targets)
• Source Code Repositories (Technology targets)

Containment Actions:

1. Disconnect: Isolate VPN concentrators from the internal LAN if exploitation is suspected.
2. Block IPs: Block outbound traffic to known SAFEPAY C2 infrastructure (if intelligence available) and file-sharing sites (Mega, MediaFire) often used for exfil.
3. Credential Reset: Force reset of all local admin and privileged domain accounts.

Hardening Recommendations

Immediate (24 Hours):

• Patch Edge: Apply patches for CVE-2024-1708 (ScreenConnect) and CVE-2026-50751 (Check Point) immediately.
• Disable IKEv1: Configure VPNs to use IKEv2 exclusively and disable aggressive mode if not required.
• MFA Enforcement: Enforce phishing-resistant MFA on all VPN and RMM portals.

Short-Term (2 Weeks):

• Network Segmentation: Implement Zero Trust segmentation to separate manufacturing/OT networks from IT administrative layers.
• Egress Filtering: Restrict outbound RDP (TCP 3389) and SMB (TCP 445) traffic from workstations.
• VSS Hardening: Implement VSS protection policies to prevent rapid deletion of shadow copies.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub