safepay Ransomware Group

Key insights

• •Gains initial access through exploitation of vulnerabilities in VPNs and RDP endpoints, stolen credentials, and social engineering.
• •Utilizes a custom ransomware strain that encrypts files with a '.safepay' extension and includes ransom notes.
• •Employs double extortion tactics by threatening to publish stolen data if ransoms are not paid.
• •Often engages in aggressive victim communication, including direct phone calls to coerce payment.
• •Exploits vulnerabilities like CVE-2024-21762 for unauthorized code execution.
• •Targets sectors such as healthcare, construction, and information services with over 450 documented victims by 2026.