SafePay Ransomware Group Tactics: CISA Highlights Advanced Techniques and Threat Actor Tactics

Introduction

The cybersecurity landscape continues to evolve at an unprecedented pace, driven by increasingly sophisticated ransomware groups and state-linked threat actors. In October 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued critical advisories detailing two distinct but equally concerning cyber threats: the SafePay ransomware group's advanced tactics and Chinese government-linked threat actors' systematic data theft operations. These reports reveal a maturing ransomware ecosystem where criminal enterprises and nation-state actors are converging techniques to maximize impact and minimize detection.

The SafePay ransomware group has emerged as one of the most active ransomware operators in 2026, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. Simultaneously, Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, have been conducting systematic campaigns to steal sensitive data from organizations worldwide, including U.S. critical infrastructure sectors. Understanding these threats requires comprehensive analysis of their tactics, techniques, and procedures (TTPs) to develop effective defense strategies.

SafePay Ransomware Group: Advanced RCE and Persistence Tactics

The SafePay ransomware group represents a sophisticated evolution in ransomware operations, combining advanced technical capabilities with organized criminal business models. Since August 2024, SafePay has impacted at least 600 separate victims from multiple critical infrastructure sectors, making it one of the most prolific ransomware groups of the year.

Technical Capabilities and Initial Access

SafePay threat actors employ a multi-vector approach to gain initial access to victim networks. Their primary methods include:

Credential-based Entry: The group frequently steals or guesses passwords to gain legitimate access to victim systems. This approach allows SafePay actors to bypass traditional perimeter defenses by using valid credentials.

Vulnerability Exploitation: SafePay actively exploits known vulnerabilities in security systems and remote access solutions. Documented exploits include:

• CVE-2020-3259 (Exposure of Sensitive Information to an Unauthorized Actor)
• CVE-2023-20269 (Authentication Bypass Using an Alternate Path or Channel)
• CVE-2023-27532 (Missing Authentication for Critical Function)
• CVE-2024-40711 (Deserialization of Untrusted Data)
• CVE-2024-40766 (Improper Access Control)

These vulnerabilities are typically targeted in automated scanning campaigns that identify internet-exposed systems for exploitation. Organizations can find guidance on patching and incident response in the cybersecurity category on our site.

Post-Exploitation Activities and Persistence

Once inside a victim network, SafePay threat actors establish robust persistence mechanisms:

Legitimate Tool Usage: The group heavily relies on Living-off-the-Land (LOTL) techniques, using legitimate system tools like PsExec and Windows Remote Management (WinRM) for remote command execution. This approach makes detection difficult as malicious activity blends with normal administrative tasks.

Custom PowerShell Scripts: SafePay actors deploy custom PowerShell scripts such as ShareFinder.ps1 and SharpShares.exe to enumerate network file shares and identify valuable assets for exfiltration. These tools systematically map the network structure to locate high-value data.

Security Software Disabling: Before executing their ransomware payload, SafePay threat actors commonly disable security software to avoid detection. They may also change system user passwords to lock out legitimate administrators and prevent incident response.

UAC Bypass and Privilege Escalation: The group employs User Account Control (UAC) bypass techniques to gain elevated privileges and uses token impersonation methods to maintain access at higher privilege levels.

Data Exfiltration and Encryption Techniques

SafePay's data theft operations are highly sophisticated. They use multiple legitimate tools for exfiltration:

• FileZilla and 7-Zip for compressing data before transfer
• RClone for cloud storage exfiltration to actor-controlled accounts
• WinSCP for secure file transfers
• OneDrive for cloud-based data theft

Remote desktop tools like AnyDesk and TeamViewer are installed to facilitate the transfer of ransomware and other tools onto victim systems.

The group also employs advanced encryption techniques using a hybrid approach combining ChaCha20 stream cipher with RSA public-key cryptosystem. This creates strong encryption that requires the decryption key held by the attackers. Files are appended with the .SafePay extension, making them easily identifiable.

System Recovery Disruption

SafePay threat actors actively work to prevent system recovery by:

• Halting the Volume Shadow Copy Service (VSS)
• Resetting Network Attached Storage (NAS) devices to factory settings
• This eliminates backup options and forces victims to pay the ransom

Chinese Government-Linked Threat Actors: Systematic Data Theft Campaigns

In parallel with ransomware operations, Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, have been conducting systematic campaigns to steal sensitive data from organizations worldwide. These actors target multiple critical infrastructure sectors and demonstrate a systematic, state-sponsored approach to cyber espionage.

Reconnaissance and Targeting

The threat actors employ sophisticated reconnaissance techniques using open-source scanning tools:

• BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan

They focus on scanning specific ports and services:

• Port 21 (FTP)
• Port 22 (SSH)
• Port 53 (DNS)
• Port 80 (HTTP)
• Port 443 (HTTPS)
• Port 1080 (SOCKS)

When scanning websites, they specifically enumerate PHP and ASP.NET pages to identify potential vulnerabilities.

Initial Access and Execution

The actors use command-line utilities built in popular programming languages (Python and Go) to gain initial access. They also employ JavaScript and HTML code for cross-site scripting (XSS) attacks, exploiting vulnerabilities in web applications to modify page content and harvest user credentials.

A notable XSS payload recovered by the FBI displays fake username and password fields to harvest credentials. After users enter their credentials, the payload generates a link to download a password-protected ZIP file containing the live700_v1.exe malware.

Persistence and C2 Infrastructure

To maintain persistence, the threat actors install VPN software clients on victim devices, which obfuscates command and control (C2) communications. They use SoftEther VPN installers, sometimes disguised as legitimate system files like conhost.exe or dllhost.exe.

The actors establish C2 communications through the domain dns.studiocloud.xyz, which the FBI attributes to Integrity Tech.

Tools and Techniques

The threat actors use a comprehensive toolkit including:

Scanning Tools:

• MicroScan (Python-based web application with 1,300 penetration testing scripts)
• Various open-source scanning tools for vulnerability assessment

Information Gathering Tools:

• nbtscan and nbtscan_linux for network scanning
• PackerFuzzer.py for vulnerability testing
• ShuiZe.py for web application security testing
• sqlmap.py for SQL injection testing
• wpscan for WordPress vulnerability assessment

Malware and Exfiltration Tools:

• curlc4.txt for network requests
• DiagTrack.exe (masquerading as legitimate Windows software)
• live700_v1.exe for initial infection
• conhost.exe and dllhost.exe for VPN installation
• b.exe and dc.exe for information dumping
• secretsdump.exe and secretsdump.py for credential extraction

Exploited Vulnerabilities

The threat actors successfully exploited multiple critical vulnerabilities:

• GNU Bash (CVE for remote code execution)
• ProFTPD (Unauthorized read access)
• ISC BIND (Denial of service)
• Apache Struts (Remote code execution)
• Pulse Secure (Unauthorized read access)
• GitLab (Remote code execution)
• ONLYOFFICE DocumentServer (Unauthorized write access)
• Strapi (Information disclosure)

Defense Strategies and Mitigation

For SafePay Ransomware Protection

Immediate Actions:

1. Patch Management: Prioritize patching internet-facing systems and update to supported PHP versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35). Organizations running unsupported versions (PHP 8.1 or earlier) should take systems offline until migration can be completed.

2. Inventory Management: Conduct comprehensive inventories of all PHP-based systems across the organization. Remember that PHP is often bundled within other software applications.

3. Network Segmentation: Implement strict network segmentation to limit lateral movement. Use microsegmentation where possible, especially for critical assets.

4. Security Monitoring: Focus detection on consequences rather than exploits. Monitor for:

   • Shell processes spawned from PHP worker processes
   • Web service accounts running reconnaissance commands
   • Payload downloads initiated by web server processes

5. Backup Strategy: Implement offline, immutable backups and test restoration procedures regularly. Ensure backup systems are isolated from the main network.

For Chinese Threat Actor Protection

Comprehensive Defense Strategy:

1. Disable Unused Services: Disable unused services and ports across the network infrastructure.

2. Input Validation: Sanitize web application inputs to prevent injection attacks and XSS exploitation.

3. Multi-Factor Authentication: Implement MFA for all services, especially administrative interfaces and VPN access.

4. Timely Patching: Apply security updates promptly, particularly for web applications and server software.

5. Network Monitoring: Monitor for unusual network traffic patterns, particularly to suspicious external domains.

6. Endpoint Detection: Deploy EDR solutions that can detect suspicious file movements and lateral movement activities.

7. Security Awareness: Train employees to recognize phishing attempts and social engineering tactics used by these threat actors.

Future Outlook and Recommendations

The convergence of ransomware operations and state-sponsored cyber espionage represents a significant evolution in the threat landscape. Organizations must adopt a multi-layered defense strategy that addresses both criminal and nation-state threats.

Key Recommendations:

1. Adopt Zero Trust Architecture: Implement comprehensive identity verification and network segmentation across all environments.

2. Invest in Security Analytics: Leverage machine learning for anomaly detection and threat hunting capabilities.

3. Enhance Incident Response: Develop and regularly test playbooks for both ransomware and espionage scenarios.

4. Foster Security Culture: Ensure every employee understands their role in protecting organizational assets.

5. Share Threat Intelligence: Participate in information sharing communities to stay informed about emerging threats.

Conclusion

The October 2026 CISA advisories highlight the sophisticated capabilities of both the SafePay ransomware group and Chinese government-linked threat actors. These threats represent different but equally dangerous challenges to organizational security. SafePay demonstrates the advanced technical capabilities of modern ransomware groups, while Chinese state-linked actors show the systematic, long-term approach of cyber espionage.

Defense against these threats requires comprehensive strategies that address technical vulnerabilities, organizational processes, and human factors. By implementing robust security measures, maintaining vigilance against emerging threats, and fostering a culture of security awareness, organizations can build resilience against these sophisticated attacks.

References

• CISA Advisory: #StopRansomware: SafePay Ransomware (AA26-293A)

• CISA Advisory: Chinese Government-linked Cyber Threat Actors (AA26-281A)

• CISA Critical Vulnerabilities in PHP Alert (October 2026)

• MITRE ATT&CK Framework

• Various vendor security advisories and industry reports

• CISA Cybersecurity Advisories

• MITRE ATT&CK Framework

• CISA Known Exploited Vulnerabilities Catalog