FBI Reports SafePay Ransomware Gang Targeting Over 600 Organizations Since August 2024

Since August 2024, the SafePay ransomware gang has breached at least 600 organizations across the U.S. and Europe, according to a recent advisory from international law enforcement agencies.

The FBI, along with cybersecurity agencies in Germany and the U.K., classified SafePay as one of the most active ransomware groups. The group is reportedly targeting businesses and critical infrastructure using methods such as password guessing, exploiting vulnerabilities, and conducting phishing attacks.

This advisory is based on multiple investigations by the FBI and German law enforcement, with the latest incident reported in August.

SafePay has exploited several vulnerabilities in its attacks, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.

According to the advisory, once SafePay actors gain access to a network, they establish control by creating new accounts or taking over existing ones. They then utilize legitimate system tools to navigate the network, identify valuable files, and disable security measures to evade detection.

The group employs automated scripts to target vulnerabilities in systems exposed to the internet. In some instances, they alter user passwords to hinder login attempts and disrupt their activities.

SafePay uses legitimate tools to compress and exfiltrate files before deploying ransomware on victim devices. Tools like AnyDesk and TeamViewer are reportedly used to transfer ransomware onto these systems.

Typically, SafePay holds encrypted data for ransom, demanding a portion of the victim’s revenue in cryptocurrency in exchange for the decryption key. To exert pressure on victims, representatives of the group make phone calls on their behalf.

The group’s leak site currently lists numerous German companies and government organizations across Latin America and the U.S. Experts have noted that parts of SafePay’s code resemble that of LockBit, a previously prominent ransomware operation.

Recently, SafePay claimed responsibility for attacks on major U.S. IT providers, including Conduent, which plays a critical role in Medicaid, child support, and food assistance programs. Following the ransomware attack, Conduent announced an $80 million settlement related to a class action lawsuit.

Source: The Record