At least 600 organizations in the U.S. and Europe have fallen victim to the SafePay ransomware gang since August 2024, according to a recent advisory from the FBI and cybersecurity agencies in Germany and the U.K. This group is now considered one of the most active ransomware threats, targeting businesses and critical infrastructure through various methods, including password guessing, exploiting vulnerabilities, and phishing attacks.
The advisory highlights that SafePay’s operations have been documented through multiple investigations by the FBI and German law enforcement, with the latest incidents reported in August. The group has exploited several vulnerabilities, including CVE-2020-3259 and CVE-2023-20269, among others, to gain access to networks.
Attack Methods and Techniques
Once inside a network, SafePay actors establish control by creating new accounts or taking over existing ones. They utilize legitimate system tools to navigate through the network, identify valuable files, and disable security measures to avoid detection. The group employs automated scripts to target vulnerabilities in internet-exposed systems, complicating the response efforts of affected organizations.
In some instances, the attackers change user passwords to hinder access and disrupt recovery efforts. They also use legitimate tools to compress and exfiltrate files before deploying ransomware on victim systems. Tools like AnyDesk and TeamViewer are reportedly used to facilitate the transfer of ransomware.
Ransom Demands and Pressure Tactics
SafePay typically demands a ransom in the form of cryptocurrency, often requesting a percentage of the victim’s revenue in exchange for the decryption key. To exert additional pressure, representatives of the group have been known to make phone calls to victims, further complicating their recovery efforts.
The group’s leak site currently lists numerous German companies and government organizations across Latin America and the U.S. as victims. Experts have noted that parts of SafePay’s code bear similarities to LockBit, a previously prominent ransomware operation.
Recent High-Profile Attacks
SafePay has claimed responsibility for significant attacks on major organizations, including one of the largest U.S. providers of IT products and services, British tech company Microlise, and government technology contractor Conduent. The attack on Conduent was particularly damaging due to the company’s involvement in critical services such as Medicaid and food assistance. Following the incident, Conduent announced an $80 million settlement related to a class action lawsuit stemming from the ransomware attack.
As the SafePay ransomware gang continues to pose a significant threat, organizations are urged to bolster their cybersecurity measures and remain vigilant against potential attacks. For further details, refer to the advisory from The Record.
