◢What is SafePay?

SafePay is a ransomware group: it gets into a company's network, steals data, encrypts files and demands a ransom. According to the advisory, it has been active since August 2024 and has hit at least 600 victims across North America, South America, Europe and Australia.

Encrypted files get the .SafePay extension and cannot be recovered without the key. The ransom note points to a chat on the Tor network, the demand is usually a share of the company's revenue, and a representative of the group phones the victim. If nobody pays, the stolen data is posted on a leak site.

◢How does it get into a company?

The advisory lists several ways in, and none of them is exotic:

• ▹Stolen or guessed credentials, including brute-force attacks.
• ▹Phishing.
• ▹VPN access, in some cases from IP addresses of a commercial VPN provider.
• ▹Known flaws in internet-facing devices such as firewalls and remote access servers. The advisory lists five specific vulnerabilities, some exploited with automated scripts.

Think of a reused password with no second factor, an unpatched VPN or a well-made email. If the email part interests you, I covered it in how to spot a phishing email and in why attacks come in through an email, not the server.

◢What do they do once inside?

This is the part worth understanding. According to the advisory, the attackers do not rely only on malware. They move around with legitimate system tools such as PsExec and WinRM, and with everyday programs: AnyDesk, TeamViewer, ScreenConnect, 7-Zip, WinRAR, FileZilla, WinSCP or RClone. With them they look for shared folders, compress the data and pull it out of the network.

The advisory itself warns that these tools should not be treated as malicious on their own. That is why an antivirus that only looks for known malware is not enough: what is suspicious is someone installing AnyDesk on a server at 3 a.m. on a Sunday, not the fact that AnyDesk exists.

They also switch off security software before moving through the network and sometimes change user passwords to lock people out.

◢Why do they go after backups?

Because the backup is what lets you refuse to pay. According to the advisory, they stop the Windows Volume Shadow Copy service and factory-reset the NAS devices where backups are stored. In some cases they delete every backup connected to the network.

If your backup sits on a disk or a folder that can be reached from the same network, it is just another file to the attacker. That is why the advisory stresses offline, encrypted and immutable backups, and testing that they can actually be restored.

◢What can a small company do?

You do not need a security department to cover the essentials. From the advisory's list of mitigations, these are the ones I would put first:

1. ▹Multi-factor authentication (MFA) on email, VPN and admin accounts.
2. ▹Patch whatever is exposed to the internet: VPN, firewalls, remote access servers and any device running old firmware.
3. ▹Long, unique passwords kept in a password manager. The advisory recommends lengths of 15 to 64 characters, no reuse, account lockout after repeated failed logins and no forced password changes more than once a year.
4. ▹Backups that are encrypted and immutable, with at least one offline copy, and a test restore from time to time.
5. ▹Network segmentation, so one compromised machine cannot see all the others.
6. ▹Review who has admin rights and remove the ones that are not needed. The advisory even suggests admin access only when required, with a time limit.
7. ▹Monitor network traffic and devices. The advisory highlights EDR tools, which spot odd behaviour on a machine, something that does cover the case of legitimate tools used with bad intent.
8. ▹Check for new, inactive or unknown accounts in your user directory and servers.

One that is cheaper than it looks: the advisory suggests adding a visible banner on emails that come from outside the organisation. It helps staff get suspicious in time.

◢What if they are already inside?

If nothing has been encrypted yet, the advisory recommends isolating the affected machines by taking them off the network, investigating how far the intruder got by looking at logs and activity, notifying the authorities and evicting the attacker before hardening the network. If data is already encrypted, it points to a response checklist in its #StopRansomware guide.

As for the ransom, the agencies behind the advisory do not encourage paying: they say it does not guarantee you get your data back and can fund other crime. That is those agencies' position, not legal advice. If it happens, talk as soon as you can to an incident response professional and to legal counsel.

◢What to keep in mind

An advisory like this describes one group, but the measures work against almost any ransomware. The outcome usually depends on whether there was a second factor, whether what was exposed was up to date and whether the backup survived the attack.

The other half is your staff: a large share of these attacks starts with a credential or an email. In my training sessions I work on exactly that with non-technical teams: what to do with a suspicious email, how to use a password manager and who to tell when something does not add up.