Malware

SafePay

Indicators of Compromise 1

Domain mullvad[.]net

MITRE ATT&CK TTPs 5

T1078
Valid Accounts
Defense Evasion
 T1110
Brute Force
Credential Access
 T1210
Exploitation of Remote Services
Lateral Movement
 T1485
Data Destruction
Impact
 T1566
Phishing
Initial Access

Source Articles

CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies have identified SafePay, a private ransomware group active since August 2024, as responsible for breaching over 600 critical infrastructure organizations globally. The group gains initial access through credential exposure, brute force attacks, and exploitation of VPN vulnerabilities, particularly targeting Mullvad VPN IP addresses. SafePay employs double-extortion tactics, exfiltrating sensitive data before encryption and threatening to leak it if ransoms are unpaid. The group does not use affiliates and has increasingly filled the operational gap left by the decline of BlackCat and LockBit ransomware groups.
bleeping-computer ·18h ago