Date: 10/21/2026
Severity: Critical
Summary
The SafePay ransomware group has been active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. The threat actors gain initial access through credential theft, password guessing, vulnerability exploitation, and phishing. They establish persistence through account creation or takeover, use legitimate system tools for lateral movement and reconnaissance, and disable security protections to evade detection. The group then encrypts files for ransom, demanding cryptocurrency payments from victims.
Indicators of Compromise (IOC) List
IP Address | 104.26.2.223 140.82.114.4 185.199.108.133 77.37.49.40 173.194.194.94 167.235.225.149 5.255.11.134 88.119.167.239 37.10.71.188 |
Hash | 07353237350c35d6dc2c8f143b649cd07c71f62b
BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081
d711a5af5aed48a3b36b98f4fcf52809aebef7a2
921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae
6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a
e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346
327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917
a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526
BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41
|
File Names | 1 - Copy.bat CCleaner.exe CCleaner64.exe CCleaner*.exe CCleaner*.dll dcsync.exe domains.txt DYRasWtb.exe libsmb2.dll Libwa*.dll License.txt locker.dll netscan.exe netscan.lic netscan.xml netscanNEW.zip nltest.exe oui.txt ping.txt portable.dat scan.xml sharefinder.ps1 Socks.exe Socks_werfault.exe subs.txt svchost.exe wa_3rd_party_host_*.exe winrar.exe AnyDesk.exe SharpShares.exe AcronisDiskDirector-12.5 acro.exe DiskDirector.exe Acronis.exe b2.exe nxc.exe |
Host Names | WIN-SBOE3CPNAL WIN-3IUUOFVTQAR WIN-DK18BI83M0S WIN-I1HRRJHCEIV |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | dstipaddress IN ("88.119.167.239","167.235.225.149","5.255.11.134","140.82.114.4","37.10.71.188","77.37.49.40","104.26.2.223","173.194.194.94","185.199.108.133") or srcipaddress IN ("88.119.167.239","167.235.225.149","5.255.11.134","140.82.114.4","37.10.71.188","77.37.49.40","104.26.2.223","173.194.194.94","185.199.108.133") |
Detection Query 2 : | sha1hash IN ("BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081","d711a5af5aed48a3b36b98f4fcf52809aebef7a2","07353237350c35d6dc2c8f143b649cd07c71f62b")
|
Detection Query 3 : | sha256hash IN ("BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41","e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346","327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917","921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae","a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526","6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a")
|
Detection Query 4 : | datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "1 - Copy.bat" or objectname like "CCleaner.exe" or objectname like "CCleaner64.exe" or objectname like "CCleaner%.exe" or objectname like "CCleaner%.dll" or objectname like "dcsync.exe" or objectname like "domains.txt" or objectname like "DYRasWtb.exe" or objectname like "libsmb2.dll" or objectname like "Libwa%.dll" or objectname like "License.txt" or objectname like "locker.dll" or objectname like "netscan.exe" or objectname like "netscan.lic" or objectname like "netscan.xml" or objectname like "netscanNEW.zip" or objectname like "nltest.exe" or objectname like "oui.txt" or objectname like "ping.txt" or objectname like "portable.dat" or objectname like "scan.xml" or objectname like "sharefinder.ps1" or objectname like "Socks.exe" or objectname like "Socks_werfault.exe" or objectname like "subs.txt" or objectname like "svchost.exe" or objectname like "wa_3rd_party_host_%.exe" or objectname like "winrar.exe" or objectname like "AnyDesk.exe" or objectname like "SharpShares.exe" or objectname like "AcronisDiskDirector-12.5" or objectname like "acro.exe" or objectname like "DiskDirector.exe" or objectname like "Acronis.exe" or objectname like "b2.exe" or objectname like "nxc.exe") |
Detection Query 5 : | technologygroup = "EDR" and (objectname like "1 - Copy.bat" or objectname like "CCleaner.exe" or objectname like "CCleaner64.exe" or objectname like "CCleaner%.exe" or objectname like "CCleaner%.dll" or objectname like "dcsync.exe" or objectname like "domains.txt" or objectname like "DYRasWtb.exe" or objectname like "libsmb2.dll" or objectname like "Libwa%.dll" or objectname like "License.txt" or objectname like "locker.dll" or objectname like "netscan.exe" or objectname like "netscan.lic" or objectname like "netscan.xml" or objectname like "netscanNEW.zip" or objectname like "nltest.exe" or objectname like "oui.txt" or objectname like "ping.txt" or objectname like "portable.dat" or objectname like "scan.xml" or objectname like "sharefinder.ps1" or objectname like "Socks.exe" or objectname like "Socks_werfault.exe" or objectname like "subs.txt" or objectname like "svchost.exe" or objectname like "wa_3rd_party_host_%.exe" or objectname like "winrar.exe" or objectname like "AnyDesk.exe" or objectname like "SharpShares.exe" or objectname like "AcronisDiskDirector-12.5" or objectname like "acro.exe" or objectname like "DiskDirector.exe" or objectname like "Acronis.exe" or objectname like "b2.exe" or objectname like "nxc.exe") |
Reference:
SafePay Ransomware Overview