SafePay ranks among the most active ransomware operations of 2026, with at least 600 victims across businesses and multiple critical infrastructure sectors in North America, South America, Europe, and Australia, and investigated intrusions as recent as August 2026.

SafePay gains entry by stealing or guessing passwords, running brute force attacks, abusing exposed credentials, and exploiting VPN access, often connecting from Mullvad VPN infrastructure and using phished account profiles to exploit CVE-2020-3259 and CVE-2023-20269 in edge device products. In parallel, automated scripts sweep internet-exposed systems for CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766, showing that long-disclosed flaws remain a dependable way in.

Once inside, operators grant administrative privileges to existing accounts or create new ones with built-in tools and deploy ScreenConnect for persistent access. They disable security software before moving laterally, change user passwords to lock out legitimate staff, and conceal code through software packing and virtual machine protection, with an injected PE and a RunPE-bundled DLL recovered alongside a soc.dll component that talks to dedicated command and control infrastructure. Privileges are escalated through a COM-based User Account Control bypass and token impersonation.

Lateral movement relies on PsExec, WinRM, remote monitoring and management tools, and RDP, with new accounts created whenever administrative access is lacking. Mimikatz and DCSync tooling harvest credentials, ShareFinder.ps1, SharpShares.exe, netscan, NetExec, and nltest enumerate shares, hosts, and domain trusts, and SOCKS proxy binaries, one likely masquerading as a Windows process, tunnel traffic.

Data is staged and compressed with WinRAR and 7-Zip, then exfiltrated through FileZilla, WinSCP, and RClone to actor-controlled accounts, to OneDrive, and to Backblaze B2 storage via b2.exe, supported by separate infrastructure for exfiltration, stolen data hosting, and client login panels. AnyDesk and TeamViewer are installed to move the ransomware and supporting tools onto victim systems.

Before encryption, SafePay halts the Volume Shadow Copy Service, resets network-attached storage holding backups to factory settings, and in some cases deletes all network-attached backups. Files are then encrypted with a hybrid ChaCha20 and RSA scheme that applies full or partial encryption based on file type and size, appending .SafePay and leaving data unrecoverable without the key, after which the ransomware may delete itself.

A ransom note left on the desktop or root directory directs victims to a Tor chat portal accessed with a victim ID, where the group demands a share of company revenue in cryptocurrency. Representatives phone victims to raise pressure, and those who refuse to pay see their stolen data published on the SafePay leak site. With backup destruction, phone-based coercion, and continued exploitation of known edge device flaws, SafePay remains a priority threat for any organization with exposed remote access or reachable backups.