Full Report
Huntress has observed Akira ransomware affiliates in action, as well as ReadText34 and INC ransomware being deployed.
Analysis Summary
# Incident Report: SafePay Ransomware Campaign
## Executive Summary
SafePay is a closed, non-RaaS double-extortion ransomware group that emerged in late 2024, utilizing a variant based on leaked LockBit Black source code. The group specializes in stealing sensitive data before encrypting files with a `.safepay` extension, claiming over 270 victims by mid-2025. Huntress successfully investigated and intervened in two separate incidents where the actors utilized RDP for access and LOLBins to disable security controls.
## Incident Details
- **Discovery Date:** October 2024
- **Incident Date:** October 2024 – Ongoing (Significant activity spike in 2025)
- **Affected Organization:** Multiple (Disclosed as two disparate Huntress customers)
- **Sector:** Various (Multiple business verticals)
- **Geography:** Global / Multiple regions
## Timeline of Events
### Initial Access
- **Date/Time:** October 2024 (Incident 1)
- **Vector:** Remote Desktop Protocol (RDP)
- **Details:** The threat actor gained access to the environment via compromised or exposed RDP credentials.
### Lateral Movement
- **Details:** The actor utilized reconnaissance scripts, specifically `ShareFinder.ps1`, to identify network shares and internal assets for further movement and data identification.
### Data Exfiltration/Impact
- **Details:** In accordance with the double-extortion model, data was identified and staged for exfiltration. Following theft, the ransomware was deployed, appending the `.safepay` extension to files.
### Detection & Response
- **Detection:** Windows Defender initially blocked `ShareFinder.ps1`.
- **Response:** Threat actors attempted to manually disable Windows Defender using LOLBin (Living off the Land Binary) commands to proceed with the attack. Huntress analysts intervened following telemetry alerts.
## Attack Methodology
- **Initial Access:** Compromised Remote Desktop Protocol (RDP).
- **Persistence:** Not explicitly detailed in the snippet, but typically involves hijacked local accounts.
- **Privilege Escalation:** Use of administrative tools and LOLBins.
- **Defense Evasion:** Manual disabling of Windows Defender; use of a Cyrillic language kill switch to avoid execution in CIS countries.
- **Discovery:** Execution of `ShareFinder.ps1` to locate network resources.
- **Lateral Movement:** RDP-based movement across the internal network.
- **Impact:** Data encryption via LockBit Black-based binary; double extortion via leak site publication.
## Impact Assessment
- **Financial:** High (Ransom demands for decryption and non-leakage).
- **Data Breach:** High (Group steals folder structures and full data sets; 22+ victims listed on leak site initially, growing to 270+).
- **Operational:** Significant (System downtime due to encryption).
- **Reputational:** High (Victim names and data samples published on Tor and TON-based leak sites).
## Indicators of Compromise
- **File Indicators:**
- `readme_safepay.txt` (Ransom note)
- `*.safepay` (Encrypted file extension)
- `ShareFinder.ps1` (Reconnaissance script)
- **Behavioral Indicators:**
- Execution of commands to disable Windows Defender (e.g., `Set-MpPreference -DisableRealtimeMonitoring $true`).
- Unusual RDP login patterns.
## Response Actions
- **Containment:** Isolation of affected endpoints accessed via RDP.
- **Eradication:** Removal of the SafePay binary and associated PowerShell reconnaissance scripts.
- **Recovery:** Restoration of data from offline backups (recommended, as paying the ransom is discouraged).
## Lessons Learned
- **RDP Risks:** Exposed RDP remains a primary entry point for manual ransomware deployments.
- **Code Reuse:** Threat actors are increasingly using leaked builders (LockBit Black) to create "new" variants quickly.
- **Insecure Leak Sites:** The SafePay leak site was found to have directory indexing and Apache status endpoints exposed, potentially providing intelligence to defenders.
## Recommendations
- **Multi-Factor Authentication (MFA):** Enforce MFA on all RDP and VPN connections.
- **Endpoint Protection:** Ensure EDR/AV solutions are configured with tamper protection to prevent threat actors from disabling them via command line.
- **Network Segmentation:** Limit the reach of RDP within the network to prevent rapid lateral movement.
- **External Surface Management:** Regularly scan for exposed RDP ports and close them in favor of secure gateways.