SafePay

Initial Access Brokers frequently provide entry points through VPN vulnerability exploitation (T1190), particularly targeting Fortigate firewalls that allow local authentication while bypassing MFA.  

SafePay actively purchases valid credentials (T1078) from dark web marketplaces and conducts systematic password spraying attacks against exposed RDP endpoints (T1133). This multi-vector approach ensures consistent access to target networks.

Upon gaining access, ShareFinder.ps1 PowerShell scripts automatically map network shares and enumerate valuable data repositories. Native WinAPI calls provide real-time visibility into running processes and services, enabling targeted security tool identification and evasion.

Establishes persistence through legitimate remote management tools, particularly ScreenConnect, which blends with normal administrative traffic. QDoor backdoor deployment provides redundant command and control capabilities and maintains access even if primary channels are discovered.

Defense evasion incorporates Windows Defender disabling through SystemSettingsAdminFlows.exe LOLBin abuse without triggering alerts. Security processes and services are systematically terminated to neutralize endpoint protection. XOR string obfuscation and Cyrillic killswitch checking prevent analysis and avoid CIS country operations.

Additional LOLBins exploitation (T1202) leverages Regsvr32.exe for DLL execution while maintaining apparent legitimacy. CMSTPLUA COM interface exploitation provides reliable UAC bypass (T1548.002), while token impersonation with SeDebugPrivilege enables stealth privilege escalation.

Credential harvesting employs Mimikatz for memory-based dumping, targeting LSASS process memory, cached domain credentials, and password stores across compromised systems.

Network share enumeration and domain configuration analysis expand the credential collection scope. Specialized stealware tools provide additional harvesting capabilities.

C2 infrastructure spans both Tor hidden services and innovative TON network communications. Known C2 servers include 45.91.201.247, 77.37.49.40, 80.78.28.63, and 88.119.167.239, providing redundant communication channels resistant to takedown efforts.

Lateral movement leverages RDP for network segment propagation, SMB/Admin share access for file distribution, PowerShell remoting for command execution, and legitimate administrative tool abuse.

Batch file automation accelerates deployment, while harvested credentials enable seamless authentication to VPN concentrators and remote management tools, extending the attack surface across diverse infrastructure.

Data exfiltration utilizes FileZilla FTP transfers (T1048) for bulk data movement, Tor-based channels for anonymous transmission, and WinRAR compression (T1560.001) to reduce transfer sizes. ShareFinder.ps1 results guide selective targeting of high-value data, while post-exfiltration tool modification helps evade forensic detection.

Persistence mechanisms include ScreenConnect RMM installation, QDoor backdoor deployment, registry modifications for autostart entries, and malicious service installation for system-level persistence.

Attacks achieve full network encryption within 24 hours, destroying both physical and virtual backup systems while causing complete operational disruption across affected organizations.

The adaptive encryption engine selects ChaCha20 for systems lacking AES-NI instruction sets or deploys AES-CBC with hardware acceleration when available. Elliptic Curve Cryptography protects symmetric keys from recovery attempts. Per-file unique key generation prevents bulk decryption, while password-protected execution prevents accidental deployment as a distinctive operational security feature.

Double extortion tactics combine encryption with data theft threats. Aggressive 72-hour initial deadlines create urgency, while dual leak sites on both Tor and TON networks provide redundant platforms for publishing stolen data.

Post-encryption activities systematically destroy recovery options through shadow copy deletion (T1490), boot configuration modification, security log clearing, and anti-forensics script deployment. Hypervisor and virtual machine targeting extends destruction beyond physical systems, ensuring comprehensive impact.