It’s Not Safe To Pay SafePay | Huntress

SafePay ransomware: Huntress observed two separate intrusions where a SafePay ransomware variant encrypted files (using the .safepay extension and readme_safepay.txt notes) and published victims on a Tor/TON leak site. Attackers used valid RDP credentials from internal VPN-assigned workstations, ran ShareFinder.ps1 for network share discovery, archived data with WinRAR (and installed FileZilla), and deployed encryption via regsvr32 executing a malicious DLL; the binary shows strong overlap with leaked LockBit code, includes Cyrillic-language checks, string obfuscation, process/service termination routines, UAC bypass behavior, and shadow-copy deletion; Huntress provides detection guidance, Sigma rules, and MITRE ATT&CK mappings, and observed 22 victims listed on the leak site.