Tova Dvorin: Hello, and welcome to a special emergency episode of The Cyber Resilience Brief, a SafeBreach podcast. Today, we’re discussing SafePay. On Tuesday, October 20, the FBI, CISA, the U.S. Secret Service, Germany’s Rhineland-Palatinate State Criminal Police Office, the UK’s National Crime Agency, and the UK Northwest Regional Organized Crime Unit put their names on one joint advisory, AA26-293A. The subject is SafePay ransomware. Adrian, why does this one matter this week? Adrian Culley: Because it’s a ransomware crew that doesn’t need anything clever to get in, and the advisory says this plainly: credential exposure, brute-force passwords, and VPN access. That’s initial access technique 101. Literally the basics of initial access, and it’s the same front door we keep seeing. What’s interesting is the byline. A German state police unit and a British regional crime unit are on it, which means investigators, not just advisory writers. Tova Dvorin: Right. So this isn’t just another blog post from a vendor. This is law enforcement itself saying, “Here’s what we saw in our own cases. Be advised.” Adrian Culley: Right. The advisory says the tactics and indicators come from the FBI, the Secret Service, and the Rhineland-Palatinate investigations as recently as August 2026. That’s casework barely two months old. It also maps to MITRE ATT&CK version 20, which we recently talked about, and the indicators are published as downloadable STIX files in XML and JSON, so you can load them straight into your tooling. Tova Dvorin: Before the tradecraft, who are they? For the listener who hasn’t been actively tracking SafePay and might be hearing about this for the first time? Adrian Culley: SafePay surfaced around September to October 2024, two years ago. Depending on which tracker you read, vendor reporting describes a centralized operation rather than ransomware-as-a-service. In fact, the dark website for SafePay explicitly says they do not and will never offer ransomware-as-a-service. So there aren’t dozens of affiliates running around with their own playbooks. It’s very good tradecraft. It makes infiltration by government and intelligence agencies really difficult. Interestingly, they’re not the only closed-group cartel out there. Play, Clop, and Black Basta all spring to mind as operating in a similar closed fashion. It’s double extortion as well: steal the data first, then encrypt. Leak-site trackers counted roughly 590 claimed victims across 49 countries by mid-October. Those are the group’s own claims, so treat them as claims. Tova Dvorin: And a centralized crew means one team’s habits, not a hundred affiliates’ different habits. Adrian Culley: That’s the upside for defenders. One team repeats itself, and a detection built for one of its intrusions tends to transfer to the next. The advisory’s tool list is short, and frankly, it’s the most useful part of the advisory: FileZilla for exfiltration, Mimikatz for stealing credentials, and a PowerShell script called ShareFinder.ps1 for hunting through network shares. Tova Dvorin: Those aren’t exotic. I can name two of those at a dinner party. Adrian Culley: That’s the point, Tova. Nothing here needs a zero-day. Mimikatz is years-old credential theft tooling. FileZilla is a legitimate file transfer client that your own staff might use. ShareFinder lists shares an account can read. Each piece is mundane. The risk is the sequence, the chain, and how fast a disciplined team runs it. Tova Dvorin: Speaking of fast, what do we know about the clock here? Adrian Culley: The advisory text I’ve read doesn’t put a dwell-time figure on it, so I won’t pretend it does. But several vendor write-ups describe SafePay going from initial access to encryption in roughly 24 hours, with the data theft happening first. If that’s right, your detection and response window is a day, and that day probably includes a night or a weekend. Tova Dvorin: Right. Which, for most midsized organizations, means the person who’d respond to all of this is asleep. Adrian Culley: Or on leave, or it’s the on-call analyst who’s never seen this tool chain. A short clock punishes handoffs. Anything that depends on someone noticing on Monday is already too late. Tova Dvorin: So, Adrian, take me through the front door. It’s credential exposure first. What does that actually mean? Adrian Culley: It means your usernames and passwords are out there before the attacker ever touches your infrastructure. Infostealer logs, old breach dumps, a password reused from a personal account. The group doesn’t have to defeat a control. It logs in. They’re not breaking in; they’re logging in. So the question for you is: What authenticates to your VPN, and is multifactor authentication enforced on every account, not just most of them? Tova Dvorin: And the second route is brute force. Adrian Culley: Technique T1110: guessing or spraying passwords against whatever is internet-facing. It works when there’s no lockout, no multifactor authentication, and nobody watching failed logins on the gateway. Most defenders have the logs. Far fewer have an alert tuned to a thousand failures against one portal. Tova Dvorin: Now, the third route is described as exploiting VPN access. Is that a vulnerability or a misconfiguration? Adrian Culley: It’s both. And this time, the advisory names them. It says SafePay uses phished account profiles, connections from known bad VPN addresses, and exploits known edge-device CVEs. Two sit on the VPN path: CVE-2023-20269, an information disclosure vulnerability, and CVE-2023-20269, an authentication bypass. The vendor advisories place both in Cisco ASA and Firepower. Separate vendor reporting also describes misconfigurations allowing local accounts to bypass multifactor authentication. Check both on your own gateway tonight. Tova Dvorin: So you can have multifactor switched on and still have a side door that bypasses it. Adrian Culley: That’s the awkward one. Organizations tick the box on the main policy and forget the break-glass account, the service account, or the contractor login from 2021. Attackers find the one account the policy doesn’t cover. Tova Dvorin: Now, what about the other three CVEs? Adrian Culley: The advisory says those are exploited across internet-exposed systems with automated scripts, technique T1190. CVE-2023-27532 and CVE-2024-40711 affect Veeam Backup & Replication, per the vendor advisories. CVE-2024-40766 affects SonicWall SonicOS. So that’s your edge firewall and your backup server. None is new. The oldest is from 2023. This is patch hygiene, not zero-days. Get the backup server off the internet. Tova Dvorin: If they log in with a valid password, what does the defender even see? There’s no failed attempt. There’s no malware. Adrian Culley: That’s exactly what makes it hard. A valid login looks like an employee. What you can see is context. A first-time location or network provider for that account. A login at three in the morning local time. A session that goes straight to enumerating file shares within minutes. None is conclusive alone. Together, they’re a pattern you can alert on. The advisory describes the behavior. Turning it into a rule that fits your own baseline is your job. Tova Dvorin: Several episodes ago, we covered Medusa. Is VPN access just the ransomware entry point of 2026? Adrian Culley: Not Medusa’s details specifically, but look across this year’s joint ransomware advisories. The Gunra advisory in August described credential exposure and weak access controls on internet-facing VPN gateways. The Akira advisory described VPN services without multifactor authentication. Different crews, same door. SafePay isn’t doing anything unique at the perimeter. It’s picking the most reliable lock in the building. Tova Dvorin: Okay. They’re in. What happens next? Adrian Culley: Credentials. Mimikatz pulls secrets out of memory on a Windows machine, and one good harvest can turn a low-privilege foothold into an administrator. I’m describing the tool rather than reciting the advisory’s technique mapping, so I won’t hang an ID on it here. What matters is the effect: from one ordinary account to something that can read, copy, and delete almost anything. Tova Dvorin: Or, in plain English, one stolen password becomes the keys to the whole building. Adrian Culley: Then ShareFinder.ps1 goes shopping with those keys. It enumerates the network shares your account can read: file servers, departmental drives, and backup shares. The advisory describes it as being used to hunt for data to steal. So the attacker isn’t browsing. They’re running a query: “Show me everything this account can reach, then I’ll decide what’s worth taking.” Tova Dvorin: And that makes the permissions in those shares the real story behind this story. Adrian Culley: It does. And that’s a lever defenders actually can control. A discovery script is only as dangerous as the access it finds. If domain users can read the finance drive, data theft is cheap. If access is tight, the same script comes back mostly empty. That’s not a tooling problem. It’s a housekeeping problem, and it’s a fixable problem. Tova Dvorin: Well, then there’s exfiltration. Why do you care that it’s FileZilla specifically for this one? Adrian Culley: Because it’s a legitimate SFTP and FTP client, malware signatures and hash blocklists don’t necessarily light up. The advisory says SafePay uses it maliciously for exfiltration. Vendor reporting also mentions WinRAR for packing data before it leaves. So the signal isn’t a malicious file, because there isn’t one. It’s an unusual outbound transfer from a machine that has never made one before. Tova Dvorin: Most organizations would just say, “Well, we have a firewall.” Adrian Culley: Most have a firewall that allows outbound traffic on nearly everything because restricting it is inconvenient, and egress filtering is unglamorous. The honest question is: Can a file server in your environment open an outbound SFTP session to an arbitrary host on the internet, and would anyone see it? If the answer is yes and no, that’s your exfiltration route. Tova Dvorin: What about the encryption itself? Is that where the detail is? Adrian Culley: Vendor reporting describes a LockBit-derived encryptor and one technique worth testing: dllhost.exe invoking CMSTPLUA COM objects for a UAC bypass. That comes from vendor research, not the joint advisory, so test it rather than assume it. But the bigger point is that encryption is the last step. By then, the data’s already gone. Tova Dvorin: Which changes how a board should think about this. They hear ransomware and think backups. Adrian Culley: Backups answer encryption. They don’t answer extortion. If the data leaves first, restoring from backup doesn’t undo the theft. And regulators, customers, and employees may still have to be told. The conversation with the board has to be about stopping the theft, not just surviving a lockout. Ask whether your incident response plan has a path for data stolen while systems are still running. Most have a restore runbook and nothing else. Tova Dvorin: And we’ll be right back. Let’s talk attribution. Who is SafePay? Adrian Culley: The advisory describes the group by its activity, not its nationality, and I’m not going to supply one. Nothing in the public text lets me say more, and I’d rather admit the gap. It’s a very closed group, making itself difficult to investigate. Trackers attach country tags, but a tag isn’t a government attribution. Low confidence in origin, high confidence in behavior, because law enforcement saw it in real cases. Either way, this is a financially motivated criminal group, and your controls have to work against whoever it is. Tova Dvorin: So there are a number of different countries that collaborated on this advisory, including the U.S., the UK, and Germany. Who’s actually getting hit? Adrian Culley: The tracker data puts the United States first, Germany second, and the UK third, which makes sense of German and British police co-signing it. Sectors skew toward manufacturing, professional services, and retail. Again, that’s who the group chose to publish, not a full count. But if you’re a midsized manufacturer in Germany or a professional services firm in the UK, this is your neighborhood. Tova Dvorin: Okay. Monday morning comes, and a CISO is listening to this on their commute. What should a defender do that isn’t just patch and train? Adrian Culley: Four things, none needing a new product, all tied to what we just walked through. One, list every account that can authenticate to your VPN and confirm multifactor authentication is enforced on all of them, including local, service, and contractor accounts. Basic cyber hygiene. Number two, make failed login patterns on the gateway raise an alert. Technique T1110 should page someone, not just fill a log. Tova Dvorin: And what about the other two? Adrian Culley: Third, outbound control. Which hosts can make an outbound SFTP or FTP connection to the internet? If the answer is most of them, you have an exfiltration route waiting. Four, share permissions. Run something equivalent to ShareFinder against yourself as a standard user and see what comes back. Start with the finance, HR, and legal shares. You’ll learn more in an afternoon from that than from a quarterly access review. Tova Dvorin: And what about credential theft on the Windows side? Adrian Culley: Treat credential dumping on a server as a high-priority incident, not a medium alert in a queue. If a Mimikatz-style technique runs on a domain-joined machine and nobody gets paged, that’s the gap. Test whether it fires, and test how long it takes a human who can isolate the host to act, not just for a ticket to fill a queue. Tova Dvorin: So my cyber sense is picking up a theme here, but we’re not saying it out loud. Let’s talk about this. Adrian Culley: The defenders I’ve worked with who handle this really well don’t ask whether they own the control. They ask whether it works against this exact sequence. Run the advisory’s chain against your own environment: credentialed VPN login, share discovery, credential theft, and SFTP exfiltration. Watch what fires and who responds. That’s the validation stage of CTEM. SafeBreach customers run that kind of exercise, but the principle holds on any platform. Tova Dvorin: And a 24-hour clock makes that test completely non-optional. Adrian Culley: A day is not long enough to find out on the day. If you haven’t tested whether your gateway alerting catches technique T1110 this quarter, you don’t know. Rehearse it before the first stolen password is used. Tova Dvorin: Now, I know we’re running out of time, so last question. Adrian, what are you watching for next? Adrian Culley: Two things, Tova. First, whether this crew’s CVE list grows. The advisory already shows entry through named vulnerabilities as well as stolen credentials, and that makes patching a race. Second, whether enforcement follows. A German state unit and the NCA co-signing suggests live investigative interest. I haven’t seen any arrests or takedowns announced alongside the advisory. If and when that changes, so does the group’s tempo. Tova Dvorin: Well, that’s our brief on SafePay for today. Check your VPN accounts today. Don’t wait until the next convenient business day, everyone. Adrian Culley: But until next time, stay safe. Stay safe with SafeBreach. Tova Dvorin: The Cyber Resilience Brief is a SafeBreach podcast, executive produced by Adrian Culley and Tova Dvorin. Music produced by Sar Jasner. Hosted, edited, and compiled on Riverside. For more about SafeBreach and how you can validate your security controls across your entire IT infrastructure, visit us at www.safebreach.com.