--- analysis: A standard detection rule for .SafePay files is inherently reactive. This hunt uses prevalence counting for staging tools (catching renamed binaries via original filename metadata) and correlates them with recovery inhibition behaviors across three different surfaces, allowing for intervention before the final payload completes. blind_spots: - id: missing-file-telemetry question: Was the host encrypted if file auditing was disabled or inhibited? requires: EDR file auditing on all endpoints risk: SafePay often disables security tools; if the EDR agent's file stream is halted, the .SafePay extension signal will be lost. stage: impact-encryption-recovery-inhibition - id: nas-reset-visibility question: Did the actor successfully reset the backup storage to factory defaults? requires: Audit logs from Network Attached Storage (NAS) devices risk: SafePay resets NAS devices to destroy backups; this hunt cannot observe those external network actions without native NAS log ingestion. stage: impact-encryption-recovery-inhibition coverage: - stage: collection-exfiltration-utilities status: covered steps: - rare-exfiltration-tools - stage: impact-encryption-recovery-inhibition status: covered steps: - recovery-inhibition-lead - safepay-file-extension - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: initial-access-exploitation-and-brute-force status: out_of_scope - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: persistence-account-manipulation status: out_of_scope - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: privilege-escalation-uac-bypass status: out_of_scope - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: discovery-share-enumeration status: out_of_scope - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: lateral-movement-rmm-psexec status: out_of_scope - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: defense-evasion-security-impairment status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: SafePay ransomware has affected over 600 victims globally. Detecting the staging and impact stages provides the last opportunity to prevent catastrophic data loss and full business interruption. methodology: model-assisted trigger: intel-report hypothesis: Adversaries have staged data using rare archival or cloud-sync tools and are now inhibiting system recovery by deleting shadow copies before executing a ransomware payload that renames user files to include the .SafePay extension. labels: - hunt - attack.t1560.001 - attack.t1048 - attack.t1567.002 - attack.t1486 - attack.t1490 - attack.t1070.004 - defense evasion - discovery - exfiltration - impact - initial access - lateral movement - persistence - privilege escalation name: 'SafePay Ransomware: Exfiltration and Impact' parameters: exfil_tools: default: - 7z.exe - winrar.exe - rclone.exe - filezilla.exe - winscp.exe - b2.exe description: Filenames and original filenames of exfiltration and archival tools used by SafePay actors. from: kind: article observed: '2026-10-20' ref: AA26-293A type: list[string] lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-10-20' ref: standard-retention type: number scope_hosts: default: [] description: Optional list of hostnames to scope the search; leave empty for fleet-wide. from: kind: manual observed: '2026-10-20' ref: analyst-scoping type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Prioritize servers hosting sensitive data, backup storage controllers, and administration workstations. SafePay typically inhibits recovery before the final encryption phase. references: - name: 'CISA AA26-293A: #StopRansomware: SafePay Ransomware' url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a related: - hunt: safepay-initial-access-and-lateral-movement reason: Initial access and lateral movement phases require identity and network-listener surfaces that are handled in a separate hunt. relation: out-of-scope-alternative - hunt: safepay-discovery-lateral-movement relation: follows scenario: stages: - name: Edge Device Exploitation and Brute Force observables: - CVE-2020-3259 - CVE-2023-20269 - CVE-2023-27532 - CVE-2024-40711 - CVE-2024-40766 - Mullvad VPN IP addresses - VPN authentication failures slug: initial-access-exploitation-and-brute-force tactic: initial-access techniques: - T1190 - T1110 - T1133 - name: Account Persistence and Privilege Gain observables: - net user /add - Password changes for existing system users - Creation of new administrative accounts slug: persistence-account-manipulation tactic: persistence techniques: - T1098 - T1136 - name: Local Privilege Escalation observables: - UAC bypass via COM component objects - Token impersonation activity slug: privilege-escalation-uac-bypass tactic: privilege-escalation techniques: - T1548.002 - T1134.001 - name: Active Directory and Share Discovery observables: - ShareFinder.ps1 - SharpShares.exe - NetExec slug: discovery-share-enumeration tactic: discovery techniques: - T1059.001 - T1059.003 - name: Lateral Movement and Remote Management observables: - psexec.exe - winrm.exe - AnyDesk.exe - TeamViewer.exe - ScreenConnect - RDP connections slug: lateral-movement-rmm-psexec tactic: lateral-movement techniques: - T1021.001 - T1021.002 - T1021.006 - T1569.002 - name: Defense Impairment and Stealth observables: - Set-MpPreference -DisableRealtimeMonitoring - Disabling security software - Software packing or VM protection slug: defense-evasion-security-impairment tactic: defense-evasion techniques: - T1685 - T1027.002 - name: Data Collection and Exfiltration observables: - 7z.exe - WinRAR.exe - rclone.exe - FileZilla.exe - WinSCP.exe - b2.exe (Backblaze) - OneDrive exfiltration slug: collection-exfiltration-utilities tactic: exfiltration techniques: - T1560.001 - T1048 - T1567 - T1567.002 - name: Encryption and Recovery Inhibition observables: - .SafePay extension - vssadmin.exe delete shadows - Resetting NAS to factory settings - Self-deletion of ransomware binary slug: impact-encryption-recovery-inhibition tactic: impact techniques: - T1486 - T1490 - T1070.004 summary: SafePay ransomware actors gain initial access through credential harvesting, brute-force attacks, and exploitation of vulnerabilities in VPN and edge devices like Cisco and Veeam. Once inside, they escalate privileges via UAC bypass, move laterally using RDP and PsExec, and utilize RMM tools for persistence before exfiltrating data and deploying encryption. series: index: 3 slug: stopransomware-safepay-ransomware title: '#StopRansomware: SafePay Ransomware' total: 3 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # SafePay Ransomware: Exfiltration and Impact SafePay ransomware, active since August 2024, follows a high-velocity chain from data collection to encryption. This hunt focuses on the high-impact finale: data exfiltration and the destructive impact phase. It identifies the use of archival and sync tools (RClone, FileZilla, B2) that are rare across the fleet—leveraging original filename metadata to catch renamed binaries—and correlates them with attempts to inhibit recovery by deleting shadow copies. Finally, it looks for the characteristic file renaming activity that appends the .SafePay extension. The hunt follows a funnel flow, using recovery inhibition as a scoping lead before fanning out to parallel behavioral and prevalence checks. ## recovery-inhibition-lead Identify hosts where system recovery mechanisms are being disabled, a common precursor to ransomware encryption. Ordering by time and host allows the analyst to see the sequence of destructive commands. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Rows showing vssadmin or wbadmin being used to delete backup data, sequenced by host. This narrows the hunt to hosts at immediate risk of impact. reads: - device_hostname - process_name - process_cmd_line - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-22' ~~~ SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ((LOWER(process_name) LIKE '%\\vssadmin.exe' AND LOWER(process_cmd_line) LIKE '%delete%') OR (LOWER(process_name) LIKE '%\\wbadmin.exe' AND LOWER(process_cmd_line) LIKE '%delete%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY device_hostname, time ``` ## parallel-corroboration parallel: - → rare-exfiltration-tools - → safepay-file-extension join: → agent-triage ## rare-exfiltration-tools Find tools like RClone or FileZilla using both robust basename matching and original filename metadata to detect renamed binaries. Stack-counting identifies which tools are rare and thus suspicious. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, exfil_tools=exfil_tools, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Execution of archival tools on five or fewer hosts. Matching against original filename catches cases where SafePay actors renamed RClone or FileZilla to evade filename filters. prevalence: by: device_hostname key: - process_name - process_original_file_name rare_below: 5 reads: - process_name - process_original_file_name - device_hostname - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-22' ~~~ SELECT LOWER(process_name) AS tool_path, process_original_file_name, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE (instr(',' || '{{exfil_tools}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR LOWER(process_name) LIKE '%\\7z.exe' OR LOWER(process_name) LIKE '%\\winrar.exe' OR LOWER(process_name) LIKE '%\\rclone.exe' OR LOWER(process_name) LIKE '%\\filezilla.exe' OR LOWER(process_name) LIKE '%\\winscp.exe' OR LOWER(process_name) LIKE '%\\b2.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY tool_path, process_original_file_name HAVING host_count <= 5 ORDER BY host_count, runs ``` ## safepay-file-extension Locate the primary indicator of encryption: the creation or renaming of files to the .SafePay extension. Including activity_id 5 catches mass renames typical of encryption. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: A burst of file renames or creations with the .safepay extension. Zero results suggests the impact stage has not yet triggered or is not visible on enrolled hosts. reads: - device_hostname - file_path - process_name - actor_user_name - time - activity_id silence: evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-10-22' ~~~ SELECT device_hostname, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE LOWER(file_path) LIKE '%.safepay' AND activity_id IN (1, 5) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## agent-triage ```agent target=hunter cite: required context: - recovery-inhibition-lead - rare-exfiltration-tools - safepay-file-extension max_iterations: 5 objective: Decide whether the evidence supports a diagnosis of SafePay ransomware activity, specifically identifying hosts where recovery inhibition (shadow deletion) or exfiltration tool usage preceded .SafePay file activity. success_criteria: A verdict of malicious for hosts with .SafePay files or shadow copy deletions combined with rare archival tools. tools: - endpoint ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host based on mass file renames or backup deletion" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: missing-file-telemetry) else: → analyst-review ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Do not reboot or power down. Preserve memory if possible before forensic imaging. ``` → analyst-review ## analyst-review ```manual target=analyst Review the hosts flagged for rare tools and recovery inhibition. Cross-reference with authorized IT maintenance windows. If legitimate archival software is found, update the rare_exfiltration_tools parameter to exclude it. ``` → close-out ## close-out ```manual target=analyst Document all confirmed malicious activity. Record the time between exfiltration tool usage and encryption start to help tune future detection latency. Note any hosts that were scoped but lacked file telemetry. ``` → end