Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Since August 2024, the SafePay ransomware group has compromised at least 600 victims across critical infrastructure sectors in North America, South America, Europe, and Australia. Threat actors gain initial access by exploiting unpatched VPN and edge-device vulnerabilities—including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766—and through brute-force credential attacks using Mullvad VPN exit nodes. Once inside, actors employ living-off-the-land binaries (PsExec, WinRM, RDP), disable security tooling, escalate privileges via UAC bypass and token impersonation, and exfiltrate data with FileZilla, RClone, WinSCP, and Backblaze B2 before encrypting files with a hybrid ChaCha20/RSA scheme and demanding cryptocurrency ransoms.

SafePay ranked among the most active ransomware groups in 2026, demonstrating that double-extortion operations targeting unpatched edge devices and flat, under-segmented networks remain highly effective. The group's systematic abuse of legitimate administrative tools underscores a growing industry-wide challenge: distinguishing malicious LOTL activity from routine IT operations without robust east-west visibility and zero-trust segmentation controls.

Why This Matters Now

SafePay is actively targeting critical infrastructure in 2026, exploiting CVEs that have had patches available for years. With 600+ confirmed victims and double-extortion tactics, organizations lacking network segmentation, MFA on VPNs, and egress controls face immediate, material ransomware risk—regulators and cyber insurers are intensifying scrutiny of exactly these gaps.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

SafePay actors exploited unpatched VPN and edge-device vulnerabilities (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766) and conducted brute-force password attacks, often routing activity through Mullvad VPN IP addresses to obscure their origin.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this SafePay incident because the attack chain relied heavily on unrestricted east-west movement, uncontrolled egress to cloud storage and TOR infrastructure, and the absence of identity-scoped workload boundaries. Had Zero Trust segmentation and inline enforcement been in place across the network fabric, the attacker's ability to pivot freely, exfiltrate at scale, and propagate ransomware across segments would likely have been significantly constrained.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Inline inspection and URL/FQDN filtering at the network edge would likely have reduced the reachability of exploit traffic targeting known-vulnerable edge devices, and anomalous inbound sessions originating from Mullvad VPN egress IPs could have been flagged or constrained before reaching internal systems.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-aware segmentation policies would likely have constrained the scope of resources reachable by elevated tokens, limiting how far a compromised account with escalated privileges could traverse the network fabric even after local privilege escalation succeeded.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement at the workload level would likely have reduced the number of internal hosts reachable from any single compromised endpoint, constraining the actors' ability to freely pivot using PsExec, WinRM, and RDP across segments that had no legitimate reason to communicate with one another.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized traffic observability across the network fabric would likely have surfaced anomalous outbound connection patterns to TOR infrastructure and unexpected remote access tool traffic, enabling earlier detection of C2 activity and giving security teams a window to respond before full attacker control was established.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Outbound FQDN filtering and egress policy enforcement would likely have blocked or constrained unauthorized data transfers to personal cloud storage destinations like Backblaze B2 and OneDrive accounts not sanctioned by policy, reducing the volume of data the actors could successfully move out of the environment.

Impact (Mitigations)

If prior segmentation and egress controls had constrained lateral movement and C2 channels in earlier stages, ransomware deployment would likely have been limited to a smaller number of reachable segments, reducing the total volume of encrypted assets and preserving isolated workloads from full-environment encryption.

Impact at a Glance

Affected Business Functions

  • Critical Infrastructure Operational Technology (OT) Systems
  • Enterprise IT Services and Network Operations
  • Data Backup and Recovery Systems
  • Remote Access and VPN Infrastructure
Operational Disruption

Estimated downtime: 18 days

Financial Impact

Estimated loss: N/A

Data Exposure

SafePay threat actors have impacted at least 600 confirmed victims across North America, South America, Europe, and Australia spanning multiple critical infrastructure sectors. Exfiltrated data categories include corporate financial records, proprietary business data, employee and customer personally identifiable information (PII), Active Directory credentials and authentication tokens, network topology and configuration files, and sensitive operational technology data. Double extortion is employed: encrypted data is held for ransom and exfiltrated data is published to a dedicated SafePay leak site if ransom is not paid. Backup data is systematically destroyed via NAS factory resets and Volume Shadow Copy deletion, eliminating recovery options without paying the ransom or restoring from offline backups. The breadth of victims across critical infrastructure sectors including healthcare, energy, and government elevates the regulatory and reputational exposure significantly.

Recommended Actions

  • • Enforce Zero Trust Segmentation with identity-based microsegmentation policies (CNSF) to restrict lateral movement between workloads and prevent privilege escalation from cascading across the environment, directly countering SafePay's use of PsExec, WinRM, and RDP pivoting.
  • • Deploy Egress Security & Policy Enforcement with FQDN filtering and outbound traffic controls (CNSF) to block unauthorized data transfers to personal cloud storage services such as OneDrive, Backblaze, and Mega, and to prevent C2 connectivity to TOR infrastructure used by SafePay actors.
  • • Activate Multicloud Visibility & Control (CNSF) with centralized traffic observability and anomaly detection to identify suspicious internal flows, unauthorized remote access tool installations (AnyDesk, TeamViewer), and anomalous outbound connections before exfiltration occurs.
  • • Implement Inline IPS with Suricata signature-based detection (CNSF) covering known CVEs exploited by SafePay (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766) and exfiltration tool traffic patterns to block initial exploitation and data staging activity at the network layer.
  • • Apply East-West Traffic Security controls (CNSF) to enforce workload-to-workload segmentation and monitor internal flows, ensuring that compromised hosts cannot freely communicate across network segments, limiting the blast radius of any successful initial access and containing ransomware propagation before encryption-at-scale occurs.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image