It’s Not Safe To Pay SafePa

What it is

Firsthand Huntress incident analysis of SafePay ransomware. The summary covers the group profile; this page carries the concrete artifacts a defender can hunt on — file/note names, the actual command lines used, and a note that SafePay's own leak infrastructure is misconfigured.

Indicators and behaviors

• Encrypted files use the .safepay extension; ransom note is readme_safepay.txt.
• Leak site is reachable via a V3 onion link plus a less-common TON ("The Open Network") link listed in the ransom note.
• The Defender-disabling LOLBin sequence matched one seen in an earlier INC ransomware deployment — a reusable detection across families.

Attack chain (Incident 1): RDP login → disable Defender → ShareFinder.ps1 (blocked in this case) → WinRAR archiving → FileZilla exfil → return via RDP ~2 days later → encrypt.

What to do

Hunt for the specific command lines. Archiving with WinRAR used a large extension exclusion list and remote UNC targets (archiving from other hosts' user directories):

WinRAR.exe  a -v5g -ed -r -tn1000d -m0 -mt5 -x*.rar -x*.JPEG ... C:\[redacted].rar \\[redacted]\C$\Users\

Encryption was deployed by loading locker.dll via regsvr32 against network shares:

"C:\Windows\SysWOW64\regsvr32.exe" /n "/i:-pass=[REDACTED] -enc=3 -uac -path=\\[REDACTED]\[SHARE]\ -uac=[REDACTED]" C:\locker.dll

Recovery/shadow-copy destruction (Huntress alerted on these, but encryption was already underway by then):

bcdedit / set{default} recoveryenabled no
wmic shadowcopy delete

Priorities implied by the chain: lock down RDP exposure (initial access in both incidents), alert on Defender-disabling LOLBins early rather than at the shadow-copy stage, and watch for regsvr32 loading an unusual DLL from C:\.

Caveats

• No network evidence of the FileZilla/FTP exfil was actually collected — exfil is inferred from tooling, not captured traffic.
• Detection alerts on bcdedit/wmic shadowcopy fired after encryption began, so they are post-hoc confirmation, not prevention — earlier stages are the ones worth catching.
• Incident 2 detail is truncated in the fetched text (Huntress agent coverage was "extremely limited"), so its chain isn't documented here.
• The verbatim strings contain [REDACTED] placeholders; the -pass/-path values are environment-specific, not fixed IOCs.

One useful aside for researchers: SafePay's own leak-site download folder is vulnerable to directory indexing, and the Apache server-status endpoint is exposed — potential avenues for victim/attribution intelligence.