Início / Ransomware Intelligence / Todos os grupos / safepay

safepay Ransomware

🔔 Criar alerta

Monitorado desde 19/11/2024

1

vítimas registradas

1

nos últimos 30 dias

0

CVEs

2 d

Última atividade

SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

Nenhuma CVE associada a este grupo nas fontes.

Táticas e técnicas (MITRE ATT&CK)

Initial Access

T1078 Valid Accounts T1091 Replication Through Removable Media T1189 Drive-by Compromise T1190 Exploit Public-Facing Application T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing Link T1566.003 Phishing: Spearphishing Voice

Execution

T1047 Windows Management Instrumentation T1047 Windows Management Instrumentation T1053.005 Scheduled Task/Job: Scheduled Task T1059 Command and Scripting Interpreter T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1059.005 Command and Scripting Interpreter: Visual Basic T1106 Native API T1129 Shared Modules T1203 Exploitation for Client Execution T1204.001 User Execution: Malicious Link T1204.002 User Execution: Malicious File

Persistence

T1078 Valid Accounts T1098 Account Manipulation T1505.004 Server Software Component: IIS Components T1542.003 Pre-OS Boot: Bootkit T1543.003 Create or Modify System Process: Windows Service T1547 Boot or Logon Autostart Execution T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.009 Boot or Logon Autostart Execution: Shortcut Modification T1574.001 Hijack Execution Flow: DLL Search Order Hijacking

Privilege Escalation

T1078 Valid Accounts T1134.002 Access Token Manipulation: Create Process with Token T1134.004 Access Token Manipulation: Parent PID Spoofing

Defense Evasion

T1014 Rootkit T1027 Obfuscated Files or Information T1027.002 Obfuscated Files or Information: Software Packing T1027.005 Obfuscated Files or Information: Indicator Removal from Tools T1027.007 Obfuscated Files or Information: Dynamic API Resolution T1027.009 Obfuscated Files or Information: Embedded Payloads T1027.013 Obfuscated Files or Information: Encrypted/Encoded File T1027.016 Obfuscated Files or Information: Junk Code Insertion T1036 Masquerading T1036.003 Masquerading: Rename Legitimate Utilities T1036.004 Masquerading: Masquerade Task or Service T1036.005 Masquerading: Match Legitimate Name or Location T1036.007 Masquerading: Double File Extension T1036.008 Masquerading: Masquerade File Type T1055 Process Injection T1055.001 Process Injection: DLL Injection T1070 Indicator Removal T1070.003 Indicator Removal: Clear Command History T1070.004 Indicator Removal: File Deletion T1070.006 Indicator Removal: Timestomp T1112 Modify Registry T1140 Deobfuscate/Decode Files or Information T1218 System Binary Proxy Execution T1218.004 System Binary Proxy Execution: InstallUtil T1218.005 System Binary Proxy Execution: Mshta T1218.007 System Binary Proxy Execution: Msiexec T1218.010 System Binary Proxy Execution: Regsvr32 T1218.011 System Binary Proxy Execution: Rundll32 T1218.014 System Binary Proxy Execution: MMC T1220 XSL Script Processing T1221 Template Injection T1222 File and Directory Permissions Modification T1497 Virtualization/Sandbox Evasion T1497.001 Virtualization/Sandbox Evasion: System Checks T1497.003 Virtualization/Sandbox Evasion: Time Based Checks T1553.002 Subvert Trust Controls: Code Signing T1562.001 Impair Defenses: Disable or Modify Tools T1562.001 Disable or Modify Tools T1562.004 Impair Defenses: Disable or Modify System Firewall T1564.001 Hidden Artifacts: Hidden Files and Directories T1574 Hijack Execution Flow T1574.013 Hijack Execution Flow: KernelCallbackTable T1620 Reflective DLL Injection T1622 Debugger Evasion

Credential Access

T1003 OS Credential Dumping T1003.003 OS Credential Dumping: NTDS T1056 Input Capture T1056.001 Input Capture: Keylogging T1110.003 Brute Force: Password Spraying T1555 Credentials from Password Stores T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning

Discovery

T1010 Application Window Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Account Discovery: Domain Account T1119 Automated Collection T1120 Peripheral Device Discovery T1124 Time Discovery T1482 Domain Trust Discovery T1614.001 System Location Discovery: System Language Discovery

Lateral Movement

T1021 Remote Services T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1021.004 Remote Services: SSH T1091 Replication Through Removable Media T1534 Internal Spearphishing

Collection

T1005 Data from Local System T1074 Data Staged T1074.001 Data Staged: Local Data Staging T1560 Archive Collected Data T1560.002 Archive Collected Data: Archive via Library T1560.003 Archive Collected Data: Archive via Custom Method

Exfiltration

T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002 Exfiltration Over Web Service

Command and Control

T1001.003 Data Obfuscation: Protocol or Service Impersonation T1008 Fallback Channels T1071.001 Application Layer Protocol: Web Protocols T1090 Proxy T1090.001 Proxy: Internal Proxy T1090.002 Proxy: External Proxy T1095 Non-Application Layer Protocol T1102 Web Service T1102.002 Web Service: Bidirectional Communication T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1132.001 Data Encoding: Standard Encoding T1219.002 Remote Access Software: Remote Desktop Software T1571 Non-Standard Port T1573 Encrypted Channel T1573.001 Encrypted Channel: Symmetric Cryptography

Impact

T1485 Data Destruction T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1491.001 Defacement: Internal Defacement T1529 System Shutdown/Reboot T1561.001 Disk Wipe: Disk Content Wipe T1561.002 Disk Wipe: Disk Structure Wipe

Resource Development

T1583.001 Acquire Infrastructure: Domains T1583.004 Acquire Infrastructure: Server T1583.006 Acquire Infrastructure: Web Services T1584.001 Compromise Infrastructure: Domains T1584.004 Compromise Infrastructure: Server T1585.001 Establish Accounts: Social Media Accounts T1585.002 Establish Accounts: Email Accounts T1587.001 Develop Capabilities: Malware T1587.002 Develop Capabilities: Code Signing Certificates T1588.002 Obtain Capabilities: Tool T1588.003 Obtain Capabilities: Code Signing Certificates T1588.004 Obtain Capabilities: Digital Certificates T1608.001 Stage Capabilities: Upload Malware T1608.002 Stage Capabilities: Upload Tool

Reconnaissance

T1589.002 Gather Victim Identity Information: Email Addresses T1591 Gather Victim Org Information T1591.004 Gather Victim Org Information: Identify Roles T1593.001 Search Open Websites/Domains: Social Media

Ferramentas observadas

Discovery Enum

Invoke-ShareFinder

Exfiltration

7-Zip · WinRAR

LOLBAS

CMSTPLUA · Regsvr32.exe · dllhost.exe

Países mais afetados (30 dias)

Estados Unidos1

Setores mais afetados (30 dias)

Healthcare1

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live