SafePay Ransomware Hit 600 Victims Using Stolen VPN Logins and Old Bugs

The FBI, CISA and the Secret Service, joined by German and UK police agencies, have put out a #StopRansomware advisory on SafePay, a ransomware crew they say has hit at least 600 victims across critical infrastructure sectors since August 2024. The agencies call it one of 2026’s most active groups. The way in is rarely clever: stolen, phished or guessed VPN passwords, often arriving from Mullvad VPN addresses, plus five known bugs in edge and backup products. After that it’s admin accounts, PsExec and WinRM, data theft with everyday tools, and encryption, in the agencies’ telling.

88.119.167[.]239 (soc.dll C2)
5.255.11[.]134 (exfiltration)
37.10.71[.]188 (exfiltration)
167.235.225[.]149 (client login panels)
77.37.49[.]40 (victim intrusion)

WIN-SBOE3CPNAL
WIN-3IUUOFVTQAR
WIN-DK18BI83M0S
WIN-I1HRRJHCEIV

327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 (locker.dll)
a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 (locker.dll)
921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae (soc.dll)

Source article: #StopRansomware: SafePay Ransomware (AA26-293A)
Publisher: Cybersecurity and Infrastructure Security Agency (CISA), joint advisory with the FBI, USSS, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit
Published: October 20, 2026
URL: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a

Executive Summary

SafePay is a ransomware operation tracked under that name by the FBI, CISA, USSS, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit; the advisory gives no vendor aliases. The authoring agencies say it has been active since August 2024, was among the most active ransomware groups of 2026, and has hit at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe and Australia, with the indicators in the advisory observed between November 2024 and August 2026. Intrusions start with exposed, phished or brute-forced credentials used against VPNs, often from Mullvad VPN addresses, together with exploitation of CVE-2020-3259 and CVE-2023-20269 (Cisco ASA and Firepower Threat Defense, per the CVE records) and, through automated scripts, CVE-2023-27532 and CVE-2024-40711 (Veeam Backup & Replication) and CVE-2024-40766 (SonicWall SonicOS). Inside, the actors gain administrative rights on existing accounts or create new ones, move with PsExec, WinRM, RDP and remote management software, bypass UAC and impersonate tokens, enumerate file shares with ShareFinder.ps1 and SharpShares.exe, disable security tools, change users’ passwords to lock them out, and use packed binaries. They stage data with 7-Zip and WinRAR and exfiltrate it with RClone, WinSCP, FileZilla, OneDrive and Backblaze b2.exe, drop ransomware through AnyDesk or TeamViewer, stop the Volume Shadow Copy Service, factory-reset NAS devices holding backups, and encrypt files with a hybrid ChaCha20 and RSA scheme that appends .SafePay, after which the binary may delete itself. The objective is double extortion: a ransom note on the desktop or root directory points to a Tor chat portal, a representative phones the victim, and data is posted to a leak site if the ransom (typically a share of revenue, paid in cryptocurrency) is not paid. The impact is encryption of production data with backups already destroyed, plus disclosure of stolen data. Hunt leads, false-positive expectations and the published indicators are detailed below; the advisory includes no YARA or Sigma rules.

ATT&CK chain: Initial Access → Execution → Persistence → Privilege Escalation → Stealth → Defense Impairment → Credential Access → Discovery → Lateral Movement → Collection → Command and Control → Exfiltration → Impact

Hunt Lead Grid

SafePay Workstation Names and Infrastructure Sweep

The advisory lists four hostnames, WIN-SBOE3CPNAL, WIN-3IUUOFVTQAR, WIN-DK18BI83M0S and WIN-I1HRRJHCEIV, which follow the random WIN- naming Windows gives a fresh install and are best read as the actors’ own machines connecting in over VPN or RDP, and nine IP addresses observed between November 2024 and August 2026: 104.26.2[.]223, 140.82.114[.]4, 185.199.108[.]133 and 77.37.49[.]40 (SafePay victim intrusion), 173.194.194[.]94 (hosting victim data), 167.235.225[.]149 (client login panels), 5.255.11[.]134 and 37.10.71[.]188 (used in exfiltration) and 88.119.167[.]239 (soc.dll command and control). The detection logic is a retrospective sweep for the four names in the workstation-name field of Windows authentication events (4624, 4625 and 4776 on domain controllers and servers), in VPN client hostname fields on Cisco ASA, Firepower and SonicWall, and in DHCP and NAC records, plus a sweep of firewall, proxy, DNS and NetFlow logs for connections to the five IPs that are not shared hosting (88.119.167[.]239, 5.255.11[.]134, 37.10.71[.]188, 167.235.225[.]149 and 77.37.49[.]40).

Sweep the full retention you have back to November 2024, since the indicators span almost two years and a quiet early intrusion may predate encryption by a long way. 104.26.2[.]223, 140.82.114[.]4, 185.199.108[.]133 and 173.194.194[.]94 fall in address ranges used by Cloudflare, GitHub and Google, and the advisory’s own disclaimer says addresses can be reassigned and should be verified before blocking; blocking them would break normal browsing, code downloads and Google services, so use them only to add weight to a host that already hits another lead (for example a server pulling a tool from GitHub shortly before share enumeration). A match on any of the four hostnames, or a connection from a server to one of the exfiltration or C2 addresses, is an escalation to incident response rather than something to tune; correlate it with the VPN and account leads below to find the entry point and the account used.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1133 (External Remote Services), detection strategy DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers; Exfiltration → T1048 (Exfiltration Over Alternative Protocol), detection strategy DET0131 Behavioral Detection Strategy for Exfiltration Over Alternative Protocol (mapping per source article for the exfiltration addresses; the hostname-to-T1133 link is our reading of how the names would appear).

Sources: “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA et al., Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article)

SafePay Toolkit File and Hash Sweep

The advisory publishes four SHA-1 and six SHA-256 hashes, among them the ransomware binary 1.exe, several builds of locker.dll (a 32-bit DLL), soc.dll with its C2 at 88.119.167[.]239, a “RunPE bundled DLL” and an “Injected PE” that point to process-hollowing style loading, plus a table of file names that includes dcsync.exe (described by the agencies as a tool to pull Active Directory credentials through DCSync), Socks.exe and Socks_werfault.exe (a SOCKS proxy, the second named to blend in with Windows Error Reporting), DYRasWtb.exe, wa_3rd_party_host_*.exe, Libwa*.dll, libsmb2.dll, netscan.exe with netscan.lic, netscan.xml and netscanNEW.zip, recon outputs domains.txt, ping.txt, oui.txt, scan.xml and subs.txt, portable.dat, and a batch file named 1 - Copy.bat. Encrypted files end in .SafePay, and the advisory says the binary may delete itself after encryption. The detection logic is an exact hash match across EDR and file-inventory data for every hash in the appendix, a file-name sweep for the distinctive names above, and a search for any file with the .SafePay extension or a burst of renames to it.

Run the hash and name sweep across all endpoints and file servers with EDR or file-inventory telemetry, and include backup repositories and archived EDR data, because the ransomware may delete itself and the advisory’s packing note means a rebuilt sample will not match. Several names in the agencies’ table belong to legitimate software (svchost.exe, nltest.exe, winrar.exe, CCleaner.exe, AnyDesk.exe, Acronis Disk Director), and the advisory itself says to verify tool use before blocking; match those only by unusual path or parent, never by name alone, and do not hash-block the legitimate copies, which would break software people need. SharpShares.exe and NetExec (nxc.exe) are public offensive and assessment tools, so hash hits on them are meaningful but renamed or recompiled copies will not match, which is why the behavioral share-enumeration lead exists. Any hit on locker.dll, soc.dll, 1.exe, dcsync.exe or a .SafePay file is an escalation to incident response; a dcsync.exe hit means every domain credential, including krbtgt, must be treated as exposed.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Impact → T1486 (Data Encrypted for Impact), detection strategy DET0215 Detection of Multi-Platform File Encryption for Impact (mapping per source article); Credential Access → T1003.006 (OS Credential Dumping: DCSync), detection strategy DET0594 Detection of Unauthorized DCSync Operations via Replication API Abuse. The advisory lists dcsync.exe and Mimikatz but maps Mimikatz to T1560.002 (Archive Collected Data: Archive via Library) and cites T1550.002 (Use Alternate Authentication Material: Pass the Hash) in the Mimikatz description; we map the DCSync tool to T1003.006 because that is the behavior the agencies describe.

Sources: “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA et al., Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article)

Edge and Veeam Exposure to the Five Listed CVEs

The agencies say SafePay used phished account profiles over Mullvad to exploit CVE-2020-3259 (CWE-200, information exposure) and CVE-2023-20269 (CWE-288, authentication bypass through an alternate path), which the CVE records place in Cisco Adaptive Security Appliance and Firepower Threat Defense: the first in web services and able to expose memory contents, the second in the remote access VPN feature and usable to brute-force credentials or open a clientless SSL VPN session. Separately, the actors exploited CVE-2023-27532 (CWE-306, missing authentication; Veeam Backup & Replication, which can expose encrypted credentials from its configuration database), CVE-2024-40711 (CWE-502, deserialization; unauthenticated remote code execution in Veeam Backup & Replication) and CVE-2024-40766 (CWE-284, improper access control in SonicWall SonicOS management and SSLVPN access) through automated scripts. The advisory gives no exploit request details, so the detection logic is an exposure sweep: inventory every ASA, Firepower, SonicWall and Veeam Backup & Replication instance, record version and patch level against each vendor’s fixed release, confirm whether the Veeam server and the firewall management and SSL VPN interfaces are reachable from the internet, and for any device that was vulnerable while exposed, review its logs for unexpected VPN sessions, new local accounts and configuration changes during the exposure window.

Use external attack-surface scans, firewall and load balancer rules, and the devices’ own version output rather than a CMDB entry alone, and check backup servers as carefully as perimeter devices, because Veeam is both an entry point and the system SafePay most wants to neutralize before encryption. Because CVE-2023-27532 and CVE-2020-3259 can leak credentials, patching does not close the hole on its own: any account or stored credential on a device that was vulnerable while reachable should be rotated after the patch, and VPN accounts should be put behind MFA. Do not rely on blocking scanner IPs, since the exploitation was automated and scripts move between hosting providers; the control that works is removing internet exposure from Veeam and management interfaces and patching. A device found vulnerable and exposed during the indicator window (November 2024 to August 2026) should be investigated as a possible initial access point, not just patched, and this sweep generalizes to any ransomware crew that works through KEV-listed edge and backup flaws.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Initial Access → T1190 (Exploit Public-Facing Application), detection strategy DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress) (mapping per source article)

Sources: “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA et al., Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article); CVE records CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, CVE Program, https://www.cve.org/CVERecord?id=CVE-2020-3259, https://www.cve.org/CVERecord?id=CVE-2023-20269, https://www.cve.org/CVERecord?id=CVE-2023-27532, https://www.cve.org/CVERecord?id=CVE-2024-40711, https://www.cve.org/CVERecord?id=CVE-2024-40766 (additional sources, linked from the source article; affected products)

VPN Brute Force and Mullvad Logins on Edge Devices

Per the advisory, SafePay gets in through exposed credentials, brute-force password attacks and VPN access, using Mullvad VPN addresses and phished account profiles; CVE-2023-20269 in the Cisco list is itself a flaw that lets an attacker brute-force VPN credentials without the usual limits. The detection logic is a rule on VPN authentication logs from ASA, Firepower and SonicWall (and on RADIUS or identity-provider logs behind them) for three patterns: many failed logins across many usernames from one source or a small set of sources, a successful login for an account that just had a run of failures, and any successful VPN login whose source address belongs to Mullvad, weighted up when the account has never connected from Mullvad before or when the login lands outside the user’s normal hours or geography.

Mullvad publishes its server addresses, so build and refresh a lookup from that list rather than relying on IP reputation feeds, and sweep at least 90 days back and preferably to November 2024. Scope the rule to VPN, SSL VPN portal and firewall management logins, and include local device accounts, which are often outside the identity provider’s lockout and MFA policy. Blocking Mullvad outright is a reasonable policy choice for many organizations but it is the wrong primary control on its own, because the actors can switch providers; the controls that matter are MFA on every VPN account, lockout after repeated failures as the advisory recommends, and removing local accounts that bypass MFA. A Mullvad-sourced success on an account with no prior history, or a success after a spray, should be treated as a probable compromise: disable the session, reset the credential and check that account against the admin-takeover lead below.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1110 (Brute Force), detection strategy DET0463 Brute Force Authentication Failures with Multi-Platform Log Correlation; Initial Access → T1133 (External Remote Services), detection strategy DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers (mapping per source article)

Sources: “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA et al., Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article)

Share Enumeration with ShareFinder, SharpShares and NetExec

Once inside, the actors ran ShareFinder.ps1, a PowerShell function that enumerates file shares across an Active Directory domain, and SharpShares.exe, a .NET share enumeration tool, to find data worth stealing; the advisory also lists NetExec (nxc.exe), netscan.exe, nltest.exe and recon output files such as domains.txt, ping.txt and scan.xml, and one victim had a tool called “S.P_Network Scanner” accompanied by a License.txt. The detection logic is process telemetry for PowerShell script blocks or command lines containing Invoke-ShareFinder or loading ShareFinder.ps1, execution of SharpShares.exe, nxc.exe or netscan.exe (by name and by the hashes in the appendix), and nltest domain-trust queries outside admin workflows; and on the network side, one host opening SMB sessions to an unusually large number of servers and listing shares (many IPC$ connections and share-enumeration calls) within minutes.

Use PowerShell script block logging (Event ID 4104), EDR process and network events, and Windows 5140 and 5145 share-access events on file servers, and sweep 90 days back. Scope out the vulnerability scanners, asset-discovery tools and penetration-test accounts that legitimately sweep shares by allowlisting their source hosts and service accounts, not by tool name, since the actors use the same open-source tools testers do; blocking the tool hashes alone is the wrong primary control because these tools are trivially recompiled or renamed. A share sweep from a non-allowlisted host, especially one that also hits the VPN, RMM or exfiltration leads, should go to incident response, and the volume-based SMB pattern generalizes to most ransomware operators, who all need to find the file servers before they steal from them.

Hunt Lead Level: 2 (Pro)

ATT&CK: Discovery → T1135 (Network Share Discovery), detection strategy DET0182 Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS; Execution → T1059.001 (Command and Scripting Interpreter: PowerShell). The advisory maps this activity only to T1059.001 and T1059.003 (Command and Scripting Interpreter: Windows Command Shell); we add T1135 because share discovery is the behavior the tools perform.

Sources: “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA et al., Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article)

Unsanctioned Remote Access Tools on Servers

The advisory says SafePay installed AnyDesk or TeamViewer on victim systems and used them to transfer ransomware and other software in, used ScreenConnect for persistence and access, and used remote management and monitoring software alongside PsExec and WinRM to move laterally. The detection logic is an EDR or software-inventory rule for installation or first execution of AnyDesk, TeamViewer, ScreenConnect or another remote access tool on servers, domain controllers, hypervisor management hosts and backup servers, and on workstations where the organization does not use that product, followed by file writes of executables or DLLs by the remote access process (the transfer the advisory describes) and outbound connections to the vendor’s relay infrastructure from hosts that have never made them.

Start with an allowlist of the organization’s sanctioned remote access product and the exact install paths, signers and account or instance IDs it uses, then alert on everything else; the advisory itself notes these tools should not be called malicious without evidence of actor control. Proxy, DNS and firewall logs give a quick retrospective sweep for connections to AnyDesk, TeamViewer and ScreenConnect cloud services from servers over the last 90 days. Blocking the vendors’ domains is a sound control where the organization does not use them, but blocking a tool the help desk relies on, or hash-blocking legitimate installers, is the wrong fix; the anchors are the host role, the instance or account that is not yours, and the executable dropped through it. A new remote access tool on a server with no ticket should be escalated and correlated with the admin-takeover lead.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1219 (Remote Access Tools), detection strategy DET0496 Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic). The advisory maps remote management software to T1569.002 (System Services: Service Execution); we use T1219 because the described behavior is persistent remote control and file transfer through a third-party remote access tool.

Sources: “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA et al., Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article)

Bulk Exfiltration with Rclone, Backblaze b2 and WinSCP

Before encrypting, SafePay compressed and split data with 7-Zip and WinRAR (the advisory says WinRAR was used to split data into segments in .RAR format) and moved it out with RClone, WinSCP and FileZilla to actor-controlled accounts, in some cases with OneDrive, and in at least one case with Backblaze’s command-line tool b2.exe; the advisory lists 5.255.11[.]134 and 37.10.71[.]188 as exfiltration addresses and 173.194.194[.]94 as hosting victim data. The detection logic is process telemetry for rclone.exe (including renamed copies, found by its command-line verbs such as copy, sync and config and by its rclone.conf file), b2.exe, WinSCP and FileZilla running on servers, multi-part archives created by 7z.exe or winrar.exe on file servers or in staging folders, and OneDrive sync clients starting on servers, joined to network data showing outbound transfer volume far above the host’s baseline to cloud storage, SFTP or the listed exfiltration addresses.

Use EDR process events and file creation events for archives, plus proxy, firewall and NetFlow logs for volume, and sweep 90 days back on file servers, database servers and backup servers first. Allowlist the sanctioned backup and sync jobs by host, account and destination rather than by binary name, because Rclone and WinSCP are legitimate admin tools and blocking them by hash or name breaks real workflows while a renamed copy walks past. Blocking all of Backblaze, OneDrive or Google is the wrong choice for most organizations; restricting which servers can reach cloud storage at all is the right one. A large outbound transfer from a server through one of these tools without a ticket is an exfiltration event and goes to incident response, because the advisory says SafePay follows exfiltration with encryption and publishes data from non-paying victims.

Hunt Lead Level: 2 (Pro)

ATT&CK: Collection → T1560.001 (Archive Collected Data: Archive via Utility); Exfiltration → T1048 (Exfiltration Over Alternative Protocol), detection strategy DET0131 Behavioral Detection Strategy for Exfiltration Over Alternative Protocol; Exfiltration → T1567 (Exfiltration Over Web Service), detection strategy DET0548 Detection Strategy for Exfiltration Over Web Service (mapping per source article)

Sources: “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA et al., Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article)

Admin Account Takeover Followed by PsExec and WinRM Fan-out

The advisory says SafePay establishes persistence by gaining administrative privileges on existing accounts or on newly created ones with built-in tools, looks for credentials to reach admin access while moving laterally, bypasses UAC through a COM elevation technique and uses token impersonation, then runs commands on remote systems with PsExec and WinRM and spreads over RDP and SMB; in some cases it changed users’ passwords so they could no longer log in. The detection logic is a sequence across identity and endpoint data: an account created (Windows 4720) or added to a privileged group such as Domain Admins or local Administrators (4728, 4732, 4756) with no matching change record, followed within a few hours by that same account authenticating to many hosts and either creating services (7045 on the targets, the PsExec pattern) or opening WinRM sessions (wsmprovhost.exe process creation on the targets), with a raised score when the account’s first logon of the session came over VPN from Mullvad or from one of the advisory’s WIN- hostnames.

This needs domain controller security logs, endpoint process and service-creation events, and VPN logs joined on account and time, plus a baseline of which admin accounts normally fan out to how many hosts per hour; sweep 90 days back and keep it running. Tune with the change-management record and the account owner rather than suppressing PsExec or WinRM globally, since both are everyday admin tools and blocking them breaks administration; the anchor is the unexplained privilege change followed by fan-out, plus bulk password resets (4724) by the same account, which the advisory ties to locking users out. Disabling the account is the right containment; deleting it destroys the audit trail. A hit is an escalation to incident response and should trigger the pre-encryption lead’s checks immediately, because in the advisory’s sequence this is the stage just before exfiltration and encryption.

Hunt Lead Level: 3 (Elite)

ATT&CK: Persistence → T1098 (Account Manipulation), detection strategy DET0096 Account Manipulation Behavior Chain Detection; Persistence → T1136 (Create Account), detection strategy DET0583 Detection Strategy for T1136 – Create Account across platforms; Lateral Movement → T1021.002 (Remote Services: SMB/Windows Admin Shares), detection strategy DET0530 Multi-Event Detection for SMB Admin Share Lateral Movement; Lateral Movement → T1021.006 (Remote Services: Windows Remote Management), detection strategy DET0477 Behavioral Detection of WinRM-Based Remote Access; Execution → T1569.002 (System Services: Service Execution), detection strategy DET0421 Detection Strategy for System Services Service Execution; related, from the advisory: T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control) and T1134.001 (Access Token Manipulation: Token Impersonation/Theft) (mapping per source article)

Sources: “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA et al., Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article)

Pre-Encryption Sequence: Security Off, Shadow Copies Stopped, NAS Reset

According to the advisory, SafePay commonly disables security software before moving laterally (RDP sessions were used to turn off protections such as Windows Defender), changes users’ passwords, halts the Volume Shadow Copy Service, resets NAS devices holding backups to factory settings and, in some cases, deleted all network-attached backups, then encrypts with ChaCha20 and RSA, renames files to .SafePay and leaves a ransom note on the desktop or root directory. The detection logic correlates, per host and across the estate within a short window: EDR or antivirus tamper and service-stop events and Defender configuration changes (Defender operational events 5001 and 5007), the Volume Shadow Copy Service (VSS) being stopped or disabled (System log 7036 and 7040), bulk password resets (4724) from one account, and on the storage side, NAS administrative logins, factory-reset or volume-deletion events and backup jobs failing at once; two or more of these together is the alert, and the first .SafePay rename or ransom-note file creation is the last-chance trigger.

This needs EDR, Windows System and Security logs, and NAS and backup application logs forwarded off the devices to a SIEM, because a reset NAS takes its own logs with it; if the NAS cannot forward logs, at minimum alert on loss of its syslog feed and on admin logins from hosts other than the storage team’s. Build per-host baselines so that patch-night service restarts and planned NAS maintenance are suppressed by maintenance window and change record, not by event type. The response to a hit is containment, not tuning: isolate the hosts, disable the accounts involved, and protect what backups remain, since by this stage the advisory’s sequence has usually included exfiltration already. Prevention matters more than detection here, which is why the advisory stresses offline, encrypted, immutable backups; NAS and backup consoles should not accept domain admin credentials, and this correlation generalizes to almost every ransomware family, which all try to kill recovery before encrypting.

Hunt Lead Level: 3 (Elite)

ATT&CK: Defense Impairment → T1685 (Disable or Modify Tools), detection strategy DET0497 Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.; Impact → T1490 (Inhibit System Recovery), detection strategy DET0329 Behavioral Detection for T1490 – Inhibit System Recovery; Impact → T1486 (Data Encrypted for Impact), detection strategy DET0215 Detection of Multi-Platform File Encryption for Impact (mapping per source article)

Sources: “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA et al., Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article)

Hash Appendix

SafePay ransomware binary (1.exe)

The SHA-1 comes from the source article; OTX AlienVault has no file analysis for it, and VirusTotal could not be queried without an authenticated account, so MD5 and SHA-256 are not available.

MD5s

(not available)  # 1.exe (SafePay ransomware binary)

SHA1s

07353237350c35d6dc2c8f143b649cd07c71f62b  # 1.exe (SafePay ransomware binary)

SHA256s

(not available)  # 1.exe (SafePay ransomware binary)

SafePay locker.dll (three builds)

The source article gives the SHA-1 and SHA-256 of one build (327b8b61... / b498a268..., which OTX confirms belong to the same file), the SHA-256 of a second build and the SHA-1 of a third; the MD5s and the second build’s SHA-1 were sourced via OTX AlienVault. OTX gives the second build’s SHA-1 as 4278801d..., not the article’s BBFED53E..., so the article’s standalone SHA-1 belongs to a different build whose other hashes are not available (OTX has no analysis and VirusTotal could not be queried without an authenticated account).

MD5s

6b7f092ac6cd855f41d49348f5efe970  # locker.dll, build 1 (SafePay encryptor, PE32 DLL; sourced via OTX)
d1f621b82822b544153f6b531e51a611  # locker.dll, build 2 (SafePay encryptor, PE32 DLL; sourced via OTX)
(not available)  # locker.dll, build 3 (SafePay encryptor)

SHA1s

b498a2683640c983bb069fa2ea9e67cef4a3797d  # locker.dll, build 1 (SafePay encryptor, PE32 DLL)
4278801d47b15c1e9ef94c28c599c3156fd65812  # locker.dll, build 2 (SafePay encryptor, PE32 DLL; sourced via OTX)
bbfed53e3bb1f306f4da97d995cf4ae5b73ad081  # locker.dll, build 3 (SafePay encryptor)

SHA256s

327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917  # locker.dll, build 1 (SafePay encryptor, PE32 DLL)
a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526  # locker.dll, build 2 (SafePay encryptor, PE32 DLL)
(not available)  # locker.dll, build 3 (SafePay encryptor)

soc.dll, RunPE loader and injected payload

The SHA-256 values come from the source article; OTX AlienVault returned no file analysis for any of the three, and VirusTotal could not be queried without an authenticated account, so MD5 and SHA-1 are not available. The advisory ties soc.dll to C2 at 88.119.167[.]239.

MD5s

(not available)  # soc.dll (C2 to 88.119.167[.]239)
(not available)  # RunPE bundled DLL (loader)
(not available)  # Injected PE (payload loaded via RunPE)

SHA1s

(not available)  # soc.dll (C2 to 88.119.167[.]239)
(not available)  # RunPE bundled DLL (loader)
(not available)  # Injected PE (payload loaded via RunPE)

SHA256s

921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae  # soc.dll (C2 to 88.119.167[.]239)
6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a  # RunPE bundled DLL (loader)
e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346  # Injected PE (payload loaded via RunPE)

Public tools: SharpShares and NetExec

The SharpShares SHA-256 and the NetExec SHA-1 come from the source article; the SharpShares MD5 and SHA-1 were sourced via OTX AlienVault (which identifies it as a 32-bit .NET console executable), and OTX has no analysis for the NetExec SHA-1. Both are publicly available offensive and assessment tools rather than SafePay malware, so a hash block only catches these exact builds; detect the behavior in the share-enumeration lead as well.

MD5s

37c1e6931a14601bb136df5985beb0a1  # SharpShares.exe (share enumeration tool; sourced via OTX)
(not available)  # nxc / nxc.exe (NetExec)

SHA1s

c13bc01d6630d6e51f5dc3d3b0d90d8d499ff240  # SharpShares.exe (share enumeration tool; sourced via OTX)
d711a5af5aed48a3b36b98f4fcf52809aebef7a2  # nxc / nxc.exe (NetExec)

SHA256s

bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41  # SharpShares.exe (share enumeration tool)
(not available)  # nxc / nxc.exe (NetExec)

References Appendix

• “#StopRansomware: SafePay Ransomware (AA26-293A)”, CISA, FBI, USSS, Landeskriminalamt Rheinland-Pfalz, UK National Crime Agency and UK North West Regional Organised Crime Unit, Oct. 20, 2026, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (source article; TTPs, CVEs, tools, file names, IPs, hostnames, hashes, ATT&CK tables, mitigations); PDF https://www.cisa.gov/sites/default/files/2026-10/aa26-293a-stopransomware-safepay-ransomware-508c_0.pdf; STIX https://www.cisa.gov/sites/default/files/2026-10/AA26-293A-stix.json
• CVE records for CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, CVE Program, https://www.cve.org/ (affected products, linked from the source article)
• OTX AlienVault file analysis for the locker.dll and SharpShares SHA-256 values, AT&T Alien Labs, accessed Oct. 22, 2026, https://otx.alienvault.com/indicator/file/327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917, https://otx.alienvault.com/indicator/file/a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 and https://otx.alienvault.com/indicator/file/bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41 (MD5 and SHA-1 provenance)
• MITRE ATT&CK Enterprise technique and detection-strategy pages linked above, MITRE, https://attack.mitre.org/