The SafePay ransomware gang has caused significant damage to critical infrastructure organizations, affecting over 600 organizations worldwide since August 2024. To protect against such threats, it's crucial to implement robust security measures. Here are some key recommendations and actionable tips based on the latest CISA guidelines and FBI reports.
Restrict Administrative Tools and Privileges:
CISA advises network defenders to limit administrative tools and privileges to prevent lateral movement after compromise. This includes blocking lateral movement by threat actors who gain initial access through credential exposure, brute force attacks, and exploiting virtual private network (VPN) access, particularly from the 'Mullvad' provider. Implement multifactor authentication (MFA) and identity, credential, and access management (ICAM) policies to enhance account security.
Keep Systems Updated:
To secure against SafePay attacks, keep systems updated, focusing on flaws affecting VPNs, firewalls, and other edge devices. These are often targeted in SafePay ransomware operations. Additionally, keep edge devices and other internet-exposed systems updated, especially those with known vulnerabilities.
Implement Phishing Defense:
SafePay actors use phished account profiles to infiltrate networks and exploit common vulnerabilities and exposures (CVEs) for edge devices and other internet-exposed systems. Implement strong phishing defense measures to identify and mitigate these tactics.
Monitor for IOCs and TTPs:
CISA provides indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) for SafePay ransomware activity. Security teams should monitor for these indicators to detect and respond to SafePay attacks proactively.
Preventative Measures:
Unlike similar operations, SafePay emerged as a private ransomware group that doesn't work with affiliates. This makes prevention more challenging. Overall prevention scores can hide what happens after initial access. Once attackers have valid credentials, only 37% of their actions are blocked. Implementing strong preventative measures is crucial to thwarting SafePay ransomware attacks.
to protect against SafePay ransomware, implement a multi-layered security strategy, including restricting administrative privileges, keeping systems updated, enhancing phishing defense, and monitoring for IOCs and TTPs. These measures can significantly reduce the risk of becoming a victim of SafePay ransomware attacks.