--- analysis: A simple rule for UAC bypass or account creation often triggers false positives for legitimate administrative tasks. This hunt uses a gated vulnerability check and an agent-led triage to correlate vulnerable state with suspicious behavior, providing higher confidence before containment. blind_spots: - id: incomplete-vuln-scoping question: Are all firewalls and VPN gateways currently reporting their vulnerability status? requires: Complete coverage of edge devices in hb_vulnerability_finding risk: A host missing from the vulnerability inventory will bypass the lead gate and be excluded from behavioral analysis. stage: initial-access-exploitation-and-brute-force - id: agent-visibility-gap question: Can we observe account changes if they occur directly on a domain controller not enrolled in the hunt? requires: Endpoint agents on all domain controllers risk: Account manipulation on an unmonitored DC will be invisible to the hb_account_change surface. coverage: - stage: initial-access-exploitation-and-brute-force status: covered steps: - vulnerable-gate - brute-force-triage - stage: persistence-account-manipulation status: covered steps: - account-persistence - stage: privilege-escalation-uac-bypass status: covered steps: - uac-bypass-check - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: discovery-share-enumeration status: out_of_scope - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: lateral-movement-rmm-psexec status: out_of_scope - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: defense-evasion-security-impairment status: out_of_scope - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: collection-exfiltration-utilities status: out_of_scope - reason: 'Belongs to another part of the ''#StopRansomware: SafePay Ransomware'' series.' stage: impact-encryption-recovery-inhibition status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: SafePay is a top-tier ransomware threat targeting critical infrastructure with rapid post-exploitation consolidation. Identifying these early stages prevents the transition to full encryption. methodology: model-assisted trigger: intel-report hypothesis: An adversary has exploited a known edge vulnerability to gain a foothold and is consolidating control by creating administrative accounts and escalating local privileges via UAC bypass. labels: - hunt - attack.t1190 - attack.t1110 - attack.t1133 - attack.t1098 - attack.t1136 - attack.t1548.002 - attack.t1134.001 - defense evasion - discovery - exfiltration - impact - initial access - lateral movement - persistence - privilege escalation name: 'SafePay: External Access and Identity Consolidation' parameters: lookback_days: default: '14' description: History of history to examine. type: number safepay_cves: default: - CVE-2020-3259 - CVE-2023-20269 - CVE-2023-27532 - CVE-2024-40711 - CVE-2024-40766 description: CVEs associated with SafePay initial access vectors. from: kind: article observed: '2026-10-20' ref: AA26-293A type: list[string] scope_hosts: default: [] description: Limit analysis to specific hostnames identified in the scoping step. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Focus on internet-facing assets including VPN gateways, backup servers (Veeam), and firewalls. Expand to administrative workstations if account manipulation is detected. references: - name: 'CISA Advisory AA26-293A: #StopRansomware: SafePay Ransomware' url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a related: - hunt: safepay-discovery-and-lateral-movement reason: This hunt identifies the beachhead; the next hunt focuses on ShareFinder and PsExec activity. relation: follows scenario: stages: - name: Edge Device Exploitation and Brute Force observables: - CVE-2020-3259 - CVE-2023-20269 - CVE-2023-27532 - CVE-2024-40711 - CVE-2024-40766 - Mullvad VPN IP addresses - VPN authentication failures slug: initial-access-exploitation-and-brute-force tactic: initial-access techniques: - T1190 - T1110 - T1133 - name: Account Persistence and Privilege Gain observables: - net user /add - Password changes for existing system users - Creation of new administrative accounts slug: persistence-account-manipulation tactic: persistence techniques: - T1098 - T1136 - name: Local Privilege Escalation observables: - UAC bypass via COM component objects - Token impersonation activity slug: privilege-escalation-uac-bypass tactic: privilege-escalation techniques: - T1548.002 - T1134.001 - name: Active Directory and Share Discovery observables: - ShareFinder.ps1 - SharpShares.exe - NetExec slug: discovery-share-enumeration tactic: discovery techniques: - T1059.001 - T1059.003 - name: Lateral Movement and Remote Management observables: - psexec.exe - winrm.exe - AnyDesk.exe - TeamViewer.exe - ScreenConnect - RDP connections slug: lateral-movement-rmm-psexec tactic: lateral-movement techniques: - T1021.001 - T1021.002 - T1021.006 - T1569.002 - name: Defense Impairment and Stealth observables: - Set-MpPreference -DisableRealtimeMonitoring - Disabling security software - Software packing or VM protection slug: defense-evasion-security-impairment tactic: defense-evasion techniques: - T1685 - T1027.002 - name: Data Collection and Exfiltration observables: - 7z.exe - WinRAR.exe - rclone.exe - FileZilla.exe - WinSCP.exe - b2.exe (Backblaze) - OneDrive exfiltration slug: collection-exfiltration-utilities tactic: exfiltration techniques: - T1560.001 - T1048 - T1567 - T1567.002 - name: Encryption and Recovery Inhibition observables: - .SafePay extension - vssadmin.exe delete shadows - Resetting NAS to factory settings - Self-deletion of ransomware binary slug: impact-encryption-recovery-inhibition tactic: impact techniques: - T1486 - T1490 - T1070.004 summary: SafePay ransomware actors gain initial access through credential harvesting, brute-force attacks, and exploitation of vulnerabilities in VPN and edge devices like Cisco and Veeam. Once inside, they escalate privileges via UAC bypass, move laterally using RDP and PsExec, and utilize RMM tools for persistence before exfiltrating data and deploying encryption. series: index: 1 slug: stopransomware-safepay-ransomware title: '#StopRansomware: SafePay Ransomware' total: 3 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity tlp: clear type: investigation --- # SafePay: External Access and Identity Consolidation SafePay actors use vulnerabilities in Cisco VPNs, Veeam backups, and SonicWall firewalls to enter the network. The hunt identifies exposed assets and monitors for brute-force attacks against the beachhead. The gated structure ensures the analyst only performs expensive behavioral analysis on hosts that show a real exposure. The hunt then checks for new account creations and privilege escalation attempts before an agent weighs the combined evidence and an analyst confirms the threat. ## vulnerable-gate Find devices currently reporting vulnerabilities used by SafePay for initial access. ```sqlite target=endpoint role=scoping params=(safepay_cves=safepay_cves) ~~~yaml expected: A list of device UIDs and resource paths vulnerable to the specified CVEs. Silence means no known-vulnerable assets are reporting. reads: - cve_uid - device_uid - resource_uid - severity - status silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-10-22' ~~~ SELECT device_uid, cve_uid, severity, resource_uid, status FROM hb_vulnerability_finding WHERE (instr(',' || '{{safepay_cves}}' || ',', ',' || cve_uid || ',') > 0) AND status != 'suppressed' ``` ## lead-assessment ```agent target=hunter cite: required context: - vulnerable-gate max_iterations: 3 objective: 'Summarize the exposure: how many hosts are vulnerable to SafePay-linked CVEs and which CVEs are most prevalent.' success_criteria: A per-host vulnerability summary. tools: - endpoint - identity ``` ## gate-decision if~: "vulnerable-gate finds at least one host or resource with a critical or high severity vulnerability" (confidence: high, judge=hunter) then: → fan-out indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: incomplete-vuln-scoping) else: → close-out ## fan-out parallel: - → brute-force-triage - → account-persistence - → uac-bypass-check join: → triage-investigation ## brute-force-triage Identify external brute-force attempts targeting administrative or phished accounts. ```sqlite target=identity role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: A high volume of failed sign-ins from a single source IP, potentially targeting multiple accounts. reads: - actor_user_name - device_hostname - src_endpoint_ip - status_id - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-10-22' ~~~ SELECT src_endpoint_ip, actor_user_name, device_hostname, COUNT(*) as attempts, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE status_id = 2 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip, actor_user_name, device_hostname HAVING attempts > 20 ORDER BY attempts DESC ``` ## account-persistence Detect the creation of new accounts or unauthorized password resets used for persistence. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Account creation (activity_id 1) or password changes/resets (3, 4) on critical servers, especially by unexpected actors. reads: - activity_id - activity_name - actor_user_name - device_hostname - time - user_name silence: not_evidence_of_absence source: hb_account_change verified: dry-run verified_at: '2026-10-22' ~~~ SELECT device_hostname, user_name, actor_user_name, activity_name, time FROM hb_account_change WHERE activity_id IN (1, 3, 4) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## uac-bypass-check Find high-integrity processes spawned from interactive or shell-based parents, indicating UAC bypass. ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: High integrity processes with command-line arguments that imply interactive shell execution. Silence proves the absence of this specific behavior on the monitored hosts. reads: - device_hostname - integrity_level - parent_process_name - process_cmd_line - process_name - time silence: evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-22' ~~~ SELECT device_hostname, process_name, process_cmd_line, parent_process_name, integrity_level, time FROM hb_process_activity WHERE integrity_level = 'High' AND (LOWER(parent_process_name) LIKE '%\\explorer.exe' OR LOWER(parent_process_name) LIKE '%\\cmd.exe' OR LOWER(parent_process_name) LIKE '%\\powershell.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-investigation ```agent target=hunter cite: required context: - lead-assessment - brute-force-triage - account-persistence - uac-bypass-check max_iterations: 6 objective: Determine if any host showing initial access indicators (vuln + brute force) has also progressed to persistence or privilege escalation. success_criteria: A verdict of malicious, suspicious, or benign per host, citing specific rows for each stage of the attack chain. tools: - endpoint - identity ``` ## route-to-response if~: "The triage verdict is malicious for at least one host showing both account manipulation and privilege escalation." (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: agent-visibility-gap) else: → analyst-review ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Lock the actor's session and revoke the credentials used for the suspicious account activity. ``` → analyst-review ## analyst-review ```manual target=analyst Review the triage verdicts. For suspicious hosts, verify the source IPs of the auth failures and the process tree of the UAC bypass. Confirm if the account changes were authorized. ``` → close-out ## close-out ```manual target=analyst Record the vulnerable hosts identified. If the behavioral queries were empty, document the negative result as evidence of absence of post-exploitation activity on the exposed surface. ``` → end