{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "SafePay ransomware has affected over 600 victims globally. Detecting the staging and impact stages provides the last opportunity to prevent catastrophic data loss and full business interruption." }, "name": "SafePay Ransomware: Exfiltration and Impact", "type": "investigation", "labels": [ "hunt", "attack.t1560.001", "attack.t1048", "attack.t1567.002", "attack.t1486", "attack.t1490", "attack.t1070.004", "defense evasion", "discovery", "exfiltration", "impact", "initial access", "lateral movement", "persistence", "privilege escalation" ], "series": { "slug": "stopransomware-safepay-ransomware", "index": 3, "title": "#StopRansomware: SafePay Ransomware", "total": 3 }, "related": [ { "hunt": "safepay-initial-access-and-lateral-movement", "reason": "Initial access and lateral movement phases require identity and network-listener surfaces that are handled in a separate hunt.", "relation": "out-of-scope-alternative" }, { "hunt": "safepay-discovery-lateral-movement", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A standard detection rule for .SafePay files is inherently reactive. This hunt uses prevalence counting for staging tools (catching renamed binaries via original filename metadata) and correlates them with recovery inhibition behaviors across three different surfaces, allowing for intervention before the final payload completes.", "coverage": [ { "stage": "collection-exfiltration-utilities", "steps": [ "rare-exfiltration-tools" ], "status": "covered" }, { "stage": "impact-encryption-recovery-inhibition", "steps": [ "recovery-inhibition-lead", "safepay-file-extension" ], "status": "covered" }, { "stage": "initial-access-exploitation-and-brute-force", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "persistence-account-manipulation", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "privilege-escalation-uac-bypass", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "discovery-share-enumeration", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rmm-psexec", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-security-impairment", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Edge Device Exploitation and Brute Force", "slug": "initial-access-exploitation-and-brute-force", "tactic": "initial-access", "techniques": [ "T1190", "T1110", "T1133" ], "observables": [ "CVE-2020-3259", "CVE-2023-20269", "CVE-2023-27532", "CVE-2024-40711", "CVE-2024-40766", "Mullvad VPN IP addresses", "VPN authentication failures" ] }, { "name": "Account Persistence and Privilege Gain", "slug": "persistence-account-manipulation", "tactic": "persistence", "techniques": [ "T1098", "T1136" ], "observables": [ "net user /add", "Password changes for existing system users", "Creation of new administrative accounts" ] }, { "name": "Local Privilege Escalation", "slug": "privilege-escalation-uac-bypass", "tactic": "privilege-escalation", "techniques": [ "T1548.002", "T1134.001" ], "observables": [ "UAC bypass via COM component objects", "Token impersonation activity" ] }, { "name": "Active Directory and Share Discovery", "slug": "discovery-share-enumeration", "tactic": "discovery", "techniques": [ "T1059.001", "T1059.003" ], "observables": [ "ShareFinder.ps1", "SharpShares.exe", "NetExec" ] }, { "name": "Lateral Movement and Remote Management", "slug": "lateral-movement-rmm-psexec", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1021.002", "T1021.006", "T1569.002" ], "observables": [ "psexec.exe", "winrm.exe", "AnyDesk.exe", "TeamViewer.exe", "ScreenConnect", "RDP connections" ] }, { "name": "Defense Impairment and Stealth", "slug": "defense-evasion-security-impairment", "tactic": "defense-evasion", "techniques": [ "T1685", "T1027.002" ], "observables": [ "Set-MpPreference -DisableRealtimeMonitoring", "Disabling security software", "Software packing or VM protection" ] }, { "name": "Data Collection and Exfiltration", "slug": "collection-exfiltration-utilities", "tactic": "exfiltration", "techniques": [ "T1560.001", "T1048", "T1567", "T1567.002" ], "observables": [ "7z.exe", "WinRAR.exe", "rclone.exe", "FileZilla.exe", "WinSCP.exe", "b2.exe (Backblaze)", "OneDrive exfiltration" ] }, { "name": "Encryption and Recovery Inhibition", "slug": "impact-encryption-recovery-inhibition", "tactic": "impact", "techniques": [ "T1486", "T1490", "T1070.004" ], "observables": [ ".SafePay extension", "vssadmin.exe delete shadows", "Resetting NAS to factory settings", "Self-deletion of ransomware binary" ] } ], "summary": "SafePay ransomware actors gain initial access through credential harvesting, brute-force attacks, and exploitation of vulnerabilities in VPN and edge devices like Cisco and Veeam. Once inside, they escalate privileges via UAC bypass, move laterally using RDP and PsExec, and utilize RMM tools for persistence before exfiltrating data and deploying encryption." }, "severity": "high", "rationale": "Prioritize servers hosting sensitive data, backup storage controllers, and administration workstations. SafePay typically inhibits recovery before the final encryption phase.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "Adversaries have staged data using rare archival or cloud-sync tools and are now inhibiting system recovery by deleting shadow copies before executing a ransomware payload that renames user files to include the .SafePay extension.", "parameters": { "exfil_tools": { "from": { "ref": "AA26-293A", "kind": "article", "observed": "2026-10-20" }, "type": "list[string]", "default": [ "7z.exe", "winrar.exe", "rclone.exe", "filezilla.exe", "winscp.exe", "b2.exe" ], "description": "Filenames and original filenames of exfiltration and archival tools used by SafePay actors." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-10-20" }, "type": "list[host]", "default": [], "description": "Optional list of hostnames to scope the search; leave empty for fleet-wide." }, "lookback_days": { "from": { "ref": "standard-retention", "kind": "manual", "observed": "2026-10-20" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a", "name": "CISA AA26-293A: #StopRansomware: SafePay Ransomware" } ], "blind_spots": [ { "id": "missing-file-telemetry", "risk": "SafePay often disables security tools; if the EDR agent's file stream is halted, the .SafePay extension signal will be lost.", "stage": "impact-encryption-recovery-inhibition", "question": "Was the host encrypted if file auditing was disabled or inhibited?", "requires": "EDR file auditing on all endpoints" }, { "id": "nas-reset-visibility", "risk": "SafePay resets NAS devices to destroy backups; this hunt cannot observe those external network actions without native NAS log ingestion.", "stage": "impact-encryption-recovery-inhibition", "question": "Did the actor successfully reset the backup storage to factory defaults?", "requires": "Audit logs from Network Attached Storage (NAS) devices" } ] }, "name": "SafePay Ransomware: Exfiltration and Impact", "description": "SafePay ransomware, active since August 2024, follows a high-velocity chain from data collection to encryption. This hunt focuses on the high-impact finale: data exfiltration and the destructive impact phase. It identifies the use of archival and sync tools (RClone, FileZilla, B2) that are rare across the fleet\u2014leveraging original filename metadata to catch renamed binaries\u2014and correlates them with attempts to inhibit recovery by deleting shadow copies. Finally, it looks for the characteristic file renaming activity that appends the .SafePay extension. The hunt follows a funnel flow, using recovery inhibition as a scoping lead before fanning out to parallel behavioral and prevalence checks." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "stopransomware-safepay-ransomware", "index": 3, "title": "#StopRansomware: SafePay Ransomware", "total": 3 }, "coverage": [ { "stage": "collection-exfiltration-utilities", "steps": [ "rare-exfiltration-tools" ], "status": "covered" }, { "stage": "impact-encryption-recovery-inhibition", "steps": [ "recovery-inhibition-lead", "safepay-file-extension" ], "status": "covered" }, { "stage": "initial-access-exploitation-and-brute-force", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "persistence-account-manipulation", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "privilege-escalation-uac-bypass", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "discovery-share-enumeration", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rmm-psexec", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-security-impairment", "reason": "Belongs to another part of the '#StopRansomware: SafePay Ransomware' series.", "status": "out_of_scope" } ], "rationale": "Adversaries have staged data using rare archival or cloud-sync tools and are now inhibiting system recovery by deleting shadow copies before executing a ransomware payload that renames user files to include the .SafePay extension.", "blind_spots": [ { "id": "missing-file-telemetry", "risk": "SafePay often disables security tools; if the EDR agent's file stream is halted, the .SafePay extension signal will be lost.", "stage": "impact-encryption-recovery-inhibition", "question": "Was the host encrypted if file auditing was disabled or inhibited?", "requires": "EDR file auditing on all endpoints" }, { "id": "nas-reset-visibility", "risk": "SafePay resets NAS devices to destroy backups; this hunt cannot observe those external network actions without native NAS log ingestion.", "stage": "impact-encryption-recovery-inhibition", "question": "Did the actor successfully reset the backup storage to factory defaults?", "requires": "Audit logs from Network Attached Storage (NAS) devices" } ], "scoping_notes": "Prioritize servers hosting sensitive data, backup storage controllers, and administration workstations. SafePay typically inhibits recovery before the final encryption phase.", "beyond_detection": "A standard detection rule for .SafePay files is inherently reactive. This hunt uses prevalence counting for staging tools (catching renamed binaries via original filename metadata) and correlates them with recovery inhibition behaviors across three different surfaces, allowing for intervention before the final payload completes." } }, { "id": "recovery-inhibition-lead", "type": "query", "label": "Lead: Shadow copy deletion and recovery inhibition", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ((LOWER(process_name) LIKE '%\\\\vssadmin.exe' AND LOWER(process_cmd_line) LIKE '%delete%') OR (LOWER(process_name) LIKE '%\\\\wbadmin.exe' AND LOWER(process_cmd_line) LIKE '%delete%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY device_hostname, time", "surface": "hb_process_activity", "description": "Identify hosts where system recovery mechanisms are being disabled, a common precursor to ransomware encryption. Ordering by time and host allows the analyst to see the sequence of destructive commands.", "expected_signal": "Rows showing vssadmin or wbadmin being used to delete backup data, sequenced by host. This narrows the hunt to hosts at immediate risk of impact." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Lead: Shadow copy deletion and recovery inhibition", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ((LOWER(process_name) LIKE '%\\\\vssadmin.exe' AND LOWER(process_cmd_line) LIKE '%delete%') OR (LOWER(process_name) LIKE '%\\\\wbadmin.exe' AND LOWER(process_cmd_line) LIKE '%delete%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY device_hostname, time", "silence": "not_evidence_of_absence", "expected": "Rows showing vssadmin or wbadmin being used to delete backup data, sequenced by host. This narrows the hunt to hosts at immediate risk of impact.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "rare-exfiltration-tools", "type": "query", "label": "Rare archival and exfiltration tools", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS tool_path, process_original_file_name, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{exfil_tools}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR LOWER(process_name) LIKE '%\\\\7z.exe' OR LOWER(process_name) LIKE '%\\\\winrar.exe' OR LOWER(process_name) LIKE '%\\\\rclone.exe' OR LOWER(process_name) LIKE '%\\\\filezilla.exe' OR LOWER(process_name) LIKE '%\\\\winscp.exe' OR LOWER(process_name) LIKE '%\\\\b2.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY tool_path, process_original_file_name HAVING host_count <= 5 ORDER BY host_count, runs", "surface": "hb_process_activity", "description": "Find tools like RClone or FileZilla using both robust basename matching and original filename metadata to detect renamed binaries. Stack-counting identifies which tools are rare and thus suspicious.", "expected_signal": "Execution of archival tools on five or fewer hosts. Matching against original filename catches cases where SafePay actors renamed RClone or FileZilla to evade filename filters." }, "parents": [ { "id": "recovery-inhibition-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare archival and exfiltration tools", "reads": [ "process_name", "process_original_file_name", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS tool_path, process_original_file_name, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{exfil_tools}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR LOWER(process_name) LIKE '%\\\\7z.exe' OR LOWER(process_name) LIKE '%\\\\winrar.exe' OR LOWER(process_name) LIKE '%\\\\rclone.exe' OR LOWER(process_name) LIKE '%\\\\filezilla.exe' OR LOWER(process_name) LIKE '%\\\\winscp.exe' OR LOWER(process_name) LIKE '%\\\\b2.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY tool_path, process_original_file_name HAVING host_count <= 5 ORDER BY host_count, runs", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Execution of archival tools on five or fewer hosts. Matching against original filename catches cases where SafePay actors renamed RClone or FileZilla to evade filename filters.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name", "process_original_file_name" ], "rare_below": 5 }, "verified_at": "2026-10-22" } }, { "id": "safepay-file-extension", "type": "query", "label": "SafePay ransomware extension activity", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE LOWER(file_path) LIKE '%.safepay' AND activity_id IN (1, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Locate the primary indicator of encryption: the creation or renaming of files to the .SafePay extension. Including activity_id 5 catches mass renames typical of encryption.", "expected_signal": "A burst of file renames or creations with the .safepay extension. Zero results suggests the impact stage has not yet triggered or is not visible on enrolled hosts." }, "parents": [ { "id": "recovery-inhibition-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "SafePay ransomware extension activity", "reads": [ "device_hostname", "file_path", "process_name", "actor_user_name", "time", "activity_id" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE LOWER(file_path) LIKE '%.safepay' AND activity_id IN (1, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "A burst of file renames or creations with the .safepay extension. Zero results suggests the impact stage has not yet triggered or is not visible on enrolled hosts.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "agent-triage", "type": "analytic", "label": "Triage ransomware staging and impact", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "recovery-inhibition-lead", "rare-exfiltration-tools", "safepay-file-extension" ], "objective": "Decide whether the evidence supports a diagnosis of SafePay ransomware activity, specifically identifying hosts where recovery inhibition (shadow deletion) or exfiltration tool usage preceded .SafePay file activity.", "description": "Synthesize the timeline from recovery inhibition to rare staging tools and finally to file encryption.", "max_iterations": 5, "expected_signal": "A detailed assessment per host citing the progression of malicious actions.", "success_criteria": "A verdict of malicious for hosts with .SafePay files or shadow copy deletions combined with rare archival tools." }, "parents": [ { "id": "rare-exfiltration-tools", "kind": "merge" }, { "id": "safepay-file-extension", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host based on mass file renames or backup deletion", "condition": "the triage verdict is malicious for at least one host based on mass file renames or backup deletion", "blind_spot": "missing-file-telemetry", "confidence": "high", "description": "Direct the hunt to containment for active ransomware or review for suspicious tool usage.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Halt active encryption and data exfiltration by severing the host's network connectivity.", "instructions": "Isolate the host immediately. Do not reboot or power down. Preserve memory if possible before forensic imaging.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Manually confirm the malicious nature of identified tools and assess the extent of file encryption.", "instructions": "Review the hosts flagged for rare tools and recovery inhibition. Cross-reference with authorized IT maintenance windows. If legitimate archival software is found, update the rare_exfiltration_tools parameter to exclude it." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and document findings.", "instructions": "Document all confirmed malicious activity. Record the time between exfiltration tool usage and encryption start to help tune future detection latency. Note any hosts that were scoped but lacked file telemetry." }, "parents": [ { "id": "analyst-review" } ] } ] }