SafePay Ransomware: Edge Entry to Encryption (CISA AA26-293A)

Attacker objective. SafePay is a closed ransomware operation. It steals data, encrypts systems, and demands cryptocurrency, typically one to three percent of the victim's yearly revenue. [#5] [#6] A joint advisory from the FBI, CISA, the US Secret Service and German and UK police says it has hit at least 600 victims since August 2024 and was among the most active ransomware groups of 2026. [#1]

How it gets in. The advisory lists stolen or guessed passwords, brute force, VPN access from Mullvad addresses, and five exploited edge and backup vulnerabilities: two in Cisco ASA and FTD, two in Veeam Backup & Replication, and one in SonicWall SonicOS. CISA's catalog marks all five as used in ransomware campaigns. [#1] [#2] NCC Group found a firewall policy that let local accounts skip VPN MFA. [#4] Blackpoint reports email flooding followed by Microsoft Teams contact from a fake help desk. [#6]

What it does next. Operators work by hand with built-in tools. They enumerate shares with ShareFinder and SharpShares, dump credentials, install ScreenConnect or AnyDesk, and drop a QDoor backdoor that hollows a WerFault.exe process. [#1] [#4] They stage data with WinRAR, then move it with Rclone, WinSCP, FileZilla, Backblaze b2 or OneDrive. [#1] [#3] Before encrypting they disable Defender and delete shadow copies and, in some cases, factory-reset network backup storage. [#1] [#3] Access to encryption can take under 24 hours. [#5]

Why this pack. CISA published its advisory on 20 October 2026, after the library's existing SafePay pack. This pack is built on that advisory and adds the five KEV-confirmed CVEs, the QDoor chain, and a warning that four of CISA's nine addresses are shared hosting and must not be blocked.

Defender priority: patch or isolate the five edge and backup CVEs now, make sure every VPN account including local ones requires MFA, and alert on regsvr32 launched with -pass (Q1), regsvr32 spawning WerFault (Q3), and recovery inhibition (Q10). Protect backups so encryption cannot also destroy recovery.

Web Hunter decisions

• Atomic indicators come from CISA only. Every hash, address and hostname in Section 10 appears verbatim in the saved CISA advisory snapshot. NCC Group's QDoor analysis independently confirms 88.119.167[.]239.
• Four CISA addresses are hunt-only. 104.26.2[.]223, 140.82.114[.]4, 185.199.108[.]133 and 173.194.194[.]94 are in CISA's table, but, as an analyst note rather than a CISA statement, ranges like these commonly belong to large CDN, code-hosting and search providers. CISA itself warns that addresses may be reassigned and should be verified before blocking. Check WHOIS and ASN first. Blocking them could break unrelated services.
• Dropped. Third-party victim counts that no primary source repeats. The pack uses CISA's figure of at least 600.
• SHA-1 hashes stay in comments. Falcon IOC Management takes SHA-256 and MD5 only, so SHA-1 is hunted by Q2.
• No victim names. Victims named in vendor write-ups are not repeated.
• Existing library pack. SafePay-Ransomware-Hunt (v0.3, 9 October 2026) already covers encryptor flags, discovery, staging and service stops, and carries SentinelOne tabs. This pack overlaps on tradecraft by design so it stands alone, and differs in being built on AA26-293A and adding QDoor, the KEV-confirmed edge CVEs and the hosting-address caution.

Contradictions and gaps

• Attribution. Blackpoint says researchers link SafePay to former Conti members. Halcyon lists possible former LockBit or ALPHV links. Bitdefender sees LockBit Black code lineage but a different operating model. None is confirmed.
• Extortion portal. CISA and Blackpoint give Tor addresses. SOCRadar says a TON-hosted portal. Treat Tor as confirmed and TON as unverified.
• Hostname spelling. CISA lists WIN-SBOE3CPNAL. Huntress shows WIN-SBOE3CPNALE. The pack hunts both.
• Observation window. CISA's indicators were seen between November 2024 and August 2026. Older addresses may be reassigned.
• Huntress snapshot. It is the fetch tool's extraction rather than the raw page. Only indicators CISA also lists are shipped as atomic indicators.

Overall confidence: High. A joint government advisory and three independent vendor incident analyses agree on every central claim.

Hunt hypotheses (ordered by fidelity)

Attack chain

Compression is the signature: NCC Group saw access, credential theft and encryption within two days, and others report under 24 hours. Steps 4 to 8 can happen in one night, so treat early discovery alerts as urgent.

Action vocabulary: detect alert or block, hunt search and review. Sources: CISA AA26-293A [#1] for every atomic indicator; NCC Group [#4] for the QDoor C2 and service details; Huntress [#3] for hostname spelling.

Gaps: firewall exploitation, the Fortinet-style MFA bypass, and backup-server compromise are outside endpoint telemetry. Without firewall and Veeam logs the first stage is invisible.

Technique IDs come from CISA AA26-293A (source 1, ATT&CK v20). Entries tagged with another source come from that source, not CISA. The sub-techniques T1055.012 and T1218.010 are analyst mappings of behavior described by NCC Group and Huntress.

These checks need no Falcon query. Run them in the product named in each row.

N1 · VPN and firewall: successful logins without MFA, local accounts

Where: On each VPN gateway (the NCC Group case was a FortiGate policy that let local and LDAP groups skip MFA).

# Review every VPN user group and confirm MFA applies to it
# FortiGate (example):  show user group  /  show vpn ssl settings
# Search VPN authentication logs for logins by LOCAL accounts and for source addresses in Mullvad ranges

A successful VPN login from a local account with no MFA record is the NCC Group entry path. Also check for logins by service and admin accounts.

N2 · Edge-device exploitation: Cisco ASA/FTD and SonicWall

Where: Device consoles and syslog.

# Cisco:     show version | include Software
# SonicWall: System > Status, then compare to the vendor advisory for CVE-2024-40766
# Review authentication failures and administrative logins for bursts from one address

Compare the running version against the vendor fix for CVE-2020-3259, CVE-2023-20269 and CVE-2024-40766. All three are KEV entries with known ransomware use.

N3 · Veeam Backup & Replication: version and exposure

Where: On the Veeam server.

(Get-Item 'C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Core.dll').VersionInfo.FileVersion
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in 9392,9401,6160,6162 } | Select-Object LocalAddress, LocalPort

Confirm the build includes the fixes for CVE-2023-27532 and CVE-2024-40711, and that the server is not reachable from the internet. The ports are common Veeam defaults and the file path is typical; confirm both against Veeam's documentation for your version.

N4 · Active Directory: new or recently changed accounts and admin group changes

Where: Domain controller.

Get-ADUser -Filter 'whenCreated -gt $((Get-Date).AddDays(-14))' -Properties whenCreated | Select-Object SamAccountName, whenCreated
Get-ADGroupMember 'Domain Admins' | Select-Object Name, SamAccountName

CISA says SafePay gains admin rights on existing accounts or creates new ones. Investigate any account created or elevated outside a ticket.

N5 · Email and Teams: flooding followed by external help-desk contact

Where: Mail gateway and Teams audit logs.

# Mail gateway: users who received hundreds of messages within an hour
# Teams audit: first-contact chat or call from an external tenant claiming to be IT support

Blackpoint describes spam flooding followed by a Teams approach that leads the user to install remote-access software.

N6 · Backups: unexpected factory resets, deleted restore points, stopped services

Where: Veeam console, NAS audit log, Windows System event log.

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036; StartTime=(Get-Date).AddDays(-14)} |
  Where-Object { $_.Message -match 'Volume Shadow Copy|Veeam' -and $_.Message -match 'stopped' } |
  Select-Object TimeCreated, Message

CISA says SafePay halts the Volume Shadow Copy Service and resets network backup storage to factory settings. A reset NAS or deleted restore points days before an incident is a strong signal.

N7 · Logons from attacker device names

Where: Domain controllers and VPN servers.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 50000 |
  Where-Object { $_.Properties[11].Value -match '^(WIN-SBOE3CPNALE?|WIN-3IUUOFVTQAR|WIN-DK18BI83M0S|WIN-I1HRRJHCEIV|vultr-guest)' } |
  Select-Object TimeCreated, @{n='Account';e={$_.Properties[5].Value}}, @{n='Workstation';e={$_.Properties[11].Value}}, @{n='SrcIP';e={$_.Properties[18].Value}}

Run on each domain controller. Any hit is an attacker-controlled device authenticating.

N8 · File servers: encrypted files and the ransom note

Where: File-server audit logs or an EDR file search.

Get-ChildItem -Path \\REPLACE_WITH_SERVER\REPLACE_WITH_SHARE -Recurse -Include readme_safepay.txt,*.safepay -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime

The note readme_safepay.txt and the .safepay extension confirm encryption. Do not rely on this for early warning.

All 14 queries run on Falcon sensor telemetry for Windows hosts. Firewall, Veeam and identity activity need the native checks in Section 7.

// HUNT: SafePay encryptor launch via regsvr32 (-pass with -enc/-uac/-path)
// MITRE: T1486, T1218.010, T1059.003
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: none expected -- the argument set is specific to the SafePay locker
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^regsvr32\.exe$/i
| CommandLine=/-pass=/i
| CommandLine=/(-enc=|-uac|-path=)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Published SafePay file hashes (encryptor, QDoor loader, injected PE)
// MITRE: T1486, T1027.002, T1055
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor process and file-write telemetry (ProcessRollup2, ImageHash, PeFileWritten, NewExecutableWritten)
// FALSE POSITIVES: SharpShares.exe and nxc are legitimate tools; a red team may use them
// LOOKBACK: 90d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|ImageHash|PeFileWritten|NewExecutableWritten/
| (SHA256HashData=/^(921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae|6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a|e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346|327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917|a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526|bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41)$/i or SHA1HashData=/^(07353237350c35d6dc2c8f143b649cd07c71f62b|b498a2683640c983bb069fa2ea9e67cef4a3797d|bbfed53e3bb1f306f4da97d995cf4ae5b73ad081|d711a5af5aed48a3b36b98f4fcf52809aebef7a2)$/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, TargetFileName, SHA256HashData, SHA1HashData])
| sort(@timestamp, order=desc)

// HUNT: regsvr32 spawning WerFault.exe (QDoor soc.dll RunPE hollowing)
// MITRE: T1055.012, T1218.010, T1027.002
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: none expected; software that registers a DLL which then crashes is rare and visible in the same host's crash logs
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^WerFault\.exe$/i
| ParentBaseFileName=/^regsvr32\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Connections to SafePay C2, exfiltration and login-panel addresses
// MITRE: T1071, T1048, T1090
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor network telemetry (NetworkConnectIP4)
// FALSE POSITIVES: a cloud address reassigned to an unrelated tenant since the advisory's observation window
// LOOKBACK: 90d
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["77.37.49.40","88.119.167.239","5.255.11.134","37.10.71.188","167.235.225.149"])
| table([@timestamp, aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, ImageFileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Named SafePay tooling executed (dcsync, SharpShares, netscan, NetExec, Socks, b2)
// MITRE: T1003.006, T1135, T1046, T1090, T1567
// CONF: high
// FP: medium
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: sanctioned network scanning, red-team work, and Backblaze users running b2.exe
// TUNING: exclude the admin accounts and jump hosts that legitimately run netscan or nxc, and the backup servers that run b2.exe; keep dcsync.exe and Socks_werfault.exe unconditional
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/(\\|\/)(dcsync|SharpShares|netscan|nxc|Socks|Socks_werfault|b2)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Credential dumping and DCSync command lines
// MITRE: T1003.001, T1003.006, T1550.002
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: authorized red-team or penetration-test activity
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(lsadump::dcsync|sekurlsa::|privilege::debug|mimikatz|dcsync\.exe)/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Share and network discovery (ShareFinder, SharpShares, nltest, NetExec)
// MITRE: T1135, T1018, T1482
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: admin troubleshooting with nltest; sanctioned vulnerability scanners
// TUNING: treat sharefinder and sharpshares as high-confidence; for nltest, alert only when the parent is a script host or the account is not in your admin tier list
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(sharefinder|invoke-sharefinder|sharpshares|nltest(\.exe)?\s+\/(dclist|domain_trusts|trusted_domains)|nxc(\.exe)?\s+(smb|winrm|ldap|rdp))/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Defender tamper via SystemSettingsAdminFlows or Set-MpPreference
// MITRE: T1685, T1562.001
// CONF: high
// FP: medium
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: sanctioned Defender configuration changes
// TUNING: exclude your endpoint-management service account and known configuration scripts; keep alerts for any hit within 24 hours of a remote-access or archive-tool event on the same host
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^SystemSettingsAdminFlows\.exe$/i or CommandLine=/(Set-MpPreference\s+.*-Disable(RealtimeMonitoring|BehaviorMonitoring|IOAVProtection|ScriptScanning|IntrusionPreventionSystem)|Add-MpPreference\s+.*-ExclusionPath)/i)
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: dllhost.exe launching a shell or proxy binary (COM UAC bypass)
// MITRE: T1548.002, T1218
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: installers and management agents that start helpers through COM surrogates
// TUNING: baseline 14 days and exclude the specific child command lines your software deployment tool produces
// LOOKBACK: 14d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^dllhost\.exe$/i
| FileName=/^(cmd|powershell|pwsh|rundll32|regsvr32|mshta|wscript|cscript)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Recovery inhibition (shadow copy deletion, bcdedit recovery off, VSS stop)
// MITRE: T1490, T1486
// CONF: high
// FP: low
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: backup agents that prune their own shadow copies
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(bcdedit(\.exe)?\s+\/set\s+\{?default\}?\s+recoveryenabled\s+no|bcdedit.*bootstatuspolicy\s+ignoreallfailures|wmic(\.exe)?\s+shadowcopy\s+delete|vssadmin(\.exe)?\s+delete\s+shadows|vssadmin.*resize\s+shadowstorage|net\s+stop\s+vss|sc(\.exe)?\s+(stop|config)\s+vss)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Staging and exfiltration tooling (split archives, Rclone, WinSCP, FileZilla, b2)
// MITRE: T1560.001, T1048, T1567
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: sanctioned file-transfer and backup jobs
// TUNING: allowlist the accounts and hosts that run these tools by design; prioritise hits on file servers, or within a day of a remote-access tool or discovery alert
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine=/((winrar|rar|7z|7za)(\.exe)?"?\s+a\s+.*-v\d+[kmg]|rclone(\.exe)?\s+(copy|sync|move)|b2(\.exe)?\s+(upload|sync)|winscp\.(com|exe)\s+.*\/command)/i or FileName=/^(rclone|fzsftp|filezilla|winscp)\.(exe|com)$/i)
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Remote-access tools running (ScreenConnect, AnyDesk, TeamViewer)
// MITRE: T1219, T1543.003, T1133
// CONF: medium
// FP: high
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: sanctioned help-desk and vendor remote support
// TUNING: build an allowlist of hosts and ScreenConnect instance names you run, then alert on any other instance, on servers, and on first-seen installs; start with servers and domain controllers
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(ScreenConnect\.ClientService|ScreenConnect\.WindowsClient|AnyDesk|TeamViewer|TeamViewer_Service)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: RDP fan-out from one host (run over a 4h window)
// MITRE: T1021.001, T1133
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: Falcon sensor network telemetry (NetworkConnectIP4)
// FALSE POSITIVES: jump hosts, RDP gateways, help-desk workstations
// TUNING: exclude your jump hosts and gateways by ComputerName; raise the host threshold for large administrative teams
// LOOKBACK: 4h
#event_simpleName=NetworkConnectIP4
| RemotePort=3389
| cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"])
| groupBy([aid, ComputerName], function=[count(RemoteAddressIP4, distinct=true, as=Hosts), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| Hosts >= 10
| sort(Hosts, order=desc, limit=100)

// HUNT: Remote execution via PsExec or WinRM
// MITRE: T1021.002, T1021.006, T1569.002
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor process telemetry (ProcessRollup2/SyntheticProcessRollup2)
// FALSE POSITIVES: IT administration and configuration-management tools
// TUNING: allowlist your management servers and admin accounts; alert on servers where PsExec has never run before and on hits followed by archive or discovery tools
// LOOKBACK: 14d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^(PSEXESVC|psexec|psexec64)\.exe$/i or ParentBaseFileName=/^wsmprovhost\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

Hash matches (Q2) and the five core addresses (Q4) belong in Falcon IOC Management, not in Custom IOAs. Use the CSV in Section 10.

Alert packages

Ready-to-paste alert text and triage steps for the three detections closest to encryption.

// >> YOU NEED:  ComputerName   (from the alert)
// >> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"
// Host-scoped: what ran just before and after the launch
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ComputerName="REPLACE_WITH_HOSTNAME"
| table([@timestamp, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=asc)

// Environment-wide: every host that launched regsvr32 with the encryptor arguments
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^regsvr32\.exe$/i
| CommandLine=/-pass=/i
| groupBy([ComputerName], function=[count(as=Launches), min(@timestamp, as=FirstSeen)], limit=500)
| sort(FirstSeen, order=asc, limit=100)

// >> YOU NEED:  ComputerName   (from the alert)
// >> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"
// Host-scoped: connections made by WerFault.exe
#event_simpleName=NetworkConnectIP4
| ComputerName="REPLACE_WITH_HOSTNAME"
| ImageFileName=/WerFault\.exe$/i
| table([@timestamp, RemoteAddressIP4, RemotePort, ImageFileName])
| sort(@timestamp, order=asc)

// Environment-wide: every host where regsvr32 started WerFault
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^WerFault\.exe$/i
| ParentBaseFileName=/^regsvr32\.exe$/i
| groupBy([ComputerName], function=[count(as=Hits), min(@timestamp, as=FirstSeen)], limit=500)
| sort(FirstSeen, order=asc, limit=100)

// >> YOU NEED:  ComputerName   (from the alert)
// >> FILL IN:   ComputerName="REPLACE_WITH_HOSTNAME"
// Host-scoped: what else ran on this host in the window
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ComputerName="REPLACE_WITH_HOSTNAME"
| table([@timestamp, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=asc)

// Environment-wide: every host that ran a shadow copy deletion in the window
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(wmic(\.exe)?\s+shadowcopy\s+delete|vssadmin(\.exe)?\s+delete\s+shadows)/i
| groupBy([ComputerName], function=[count(as=Hits), min(@timestamp, as=FirstSeen)], limit=500)
| sort(FirstSeen, order=asc, limit=100)

Import only the five core addresses and six hashes. Four further addresses in CISA's table look like shared hosting, and blocking them could break unrelated services. CISA says to investigate or verify addresses before blocking.

type,value,action,severity,expiration,description,tags
ipv4,77.37.49.40,detect,high,2027-01-20,SafePay victim intrusion,campaign:SafePay
ipv4,88.119.167.239,detect,high,2027-01-20,soc.dll (QDoor) command and control,campaign:SafePay
ipv4,5.255.11.134,detect,high,2027-01-20,Used in exfiltration,campaign:SafePay
ipv4,37.10.71.188,detect,high,2027-01-20,Used in exfiltration,campaign:SafePay
ipv4,167.235.225.149,detect,high,2027-01-20,Client login panels,campaign:SafePay
sha256,921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae,prevent,critical,2027-04-20,soc.dll (QDoor loader),campaign:SafePay
sha256,6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a,prevent,critical,2027-04-20,RunPE bundled DLL,campaign:SafePay
sha256,e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346,prevent,critical,2027-04-20,Injected PE (QDoor),campaign:SafePay
sha256,327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917,prevent,critical,2027-04-20,locker.dll PE32 (encryptor),campaign:SafePay
sha256,a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526,prevent,critical,2027-04-20,locker.dll (encryptor),campaign:SafePay
sha256,bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41,detect,medium,2027-04-20,SharpShares.exe (share enumerator),campaign:SafePay
# SHA-1 values (Falcon IOC import does not take SHA-1; hunt them with Q2)
# 1.exe (ransomware binary) 07353237350c35d6dc2c8f143b649cd07c71f62b
# Locker.dll PE32 b498a2683640c983bb069fa2ea9e67cef4a3797d
# locker.dll bbfed53e3bb1f306f4da97d995cf4ae5b73ad081
# nxc (NetExec) d711a5af5aed48a3b36b98f4fcf52809aebef7a2
# NOT imported, shared hosting listed by CISA (verify with WHOIS first): 104.26.2.223 140.82.114.4 185.199.108.133 173.194.194.94

# Addresses in CISA's table that likely belong to large shared providers.
# HUNT ONLY. Do not block. Verify ownership and context first (CISA: addresses may be reassigned).

104.26.2.223  SafePay victim intrusion
140.82.114.4  SafePay victim intrusion
185.199.108.133  SafePay victim intrusion
173.194.194.94  Hosting victim data

# Attacker device names to search in logon, VPN and DHCP logs:
WIN-SBOE3CPNAL
WIN-SBOE3CPNALE
WIN-3IUUOFVTQAR
WIN-DK18BI83M0S
WIN-I1HRRJHCEIV
vultr-guest

PROCESS AND COMMAND LINES
  regsvr32.exe /n "/i:-pass=<value> -enc=3 -uac -path=\\<host>\<share>\ -uac=<value>" C:\locker.dll
  regsvr32 loading soc.dll (QDoor); WerFault.exe created suspended by regsvr32 and injected (RunPE)
  bcdedit /set {default} recoveryenabled no ; wmic shadowcopy delete ; vssadmin delete shadows ; net stop vss
  SystemSettingsAdminFlows.exe (Defender settings changed through the GUI) ; Set-MpPreference -Disable* ; Add-MpPreference -ExclusionPath
  WinRAR.exe a -v5g -ed -r -tn1000d -m0 -mt5 -x*.rar -x*.JPEG ... \\<host>\C$\Users\   (split archives of user profiles)
  ShareFinder.ps1 ; SharpShares.exe ; netscan.exe ; nltest /dclist ; nxc smb|winrm|ldap|rdp
  psexec / PSEXESVC ; wsmprovhost.exe children ; dllhost.exe spawning cmd, PowerShell, rundll32
  C:\ProgramData\<digit>.bat ; 1.bat ; 1.exe ; C:\Windows\Temp\RRZqKUbG.tmp (flagged RemoteRegDump)
SERVICES AND TOOLS
  service "ScreenConnect Client" (localsystem, auto start) ; AnyDesk ; TeamViewer ; FileZilla install then uninstall
ARTIFACTS
  extension .safepay ; ransom note readme_safepay.txt on desktop and root directory ; victim ID chat portal
  QDoor C2: 88.119.167[.]239 TCP/443, unencrypted header bytes C4 C3 C2 C1
EXTORTION
  Tor portals (Blackpoint): hxxp[:]//j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid[.]onion/
  hxxp[:]//nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid[.]onion/
  hxxp[:]//safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd[.]onion/
  contact the group within 10 days or data is leaked; demand 1 to 3 percent of revenue
EDGE AND ENTRY
  VPN logins from Mullvad ranges ; local-account VPN logins with no MFA ; attacker device name vultr-guest
  spam flooding followed by Teams contact from a fake help desk

7-Zip, WinRAR - archive and split data
FileZilla, WinSCP, Rclone (including to Mega), Backblaze b2.exe, OneDrive - exfiltration
Mimikatz, dcsync.exe - credential theft
PsExec, WinRM, RDP - lateral movement
ScreenConnect, AnyDesk, TeamViewer - persistence and tool transfer
ShareFinder.ps1 (PowerView lineage), SharpShares.exe, netscan.exe, NetExec (nxc.exe), nltest - discovery
Socks.exe, Socks_werfault.exe - tunneling
QDoor backdoor (soc.dll, UPX-packed, RunPE hollowing into WerFault.exe) - linked publicly to another ransomware group
SafePay locker (locker.dll): ChaCha20 with RSA hybrid encryption; built on the leaked LockBit builder; skips Russian-language systems
Acronis Disk Director components - listed by CISA as a legitimate tool seen in intrusions
CCleaner binaries - suspicious in enterprise, listed by CISA for masquerade or anti-forensics

[ ] All five CVEs patched or the device isolated: CVE-2020-3259 and CVE-2023-20269 (Cisco ASA/FTD), CVE-2023-27532 and CVE-2024-40711 (Veeam B&R), CVE-2024-40766 (SonicWall)
[ ] Every VPN user group, including local and LDAP accounts, requires MFA; no policy lets a group skip it
[ ] Veeam and backup storage are not internet-reachable, not domain-joined where possible, with separate credentials
[ ] Backups are encrypted, immutable and offline copies exist; a restore has been tested
[ ] Admin and service passwords are at least 15 characters with failed-login lockout
[ ] RDP inbound limited to jump hosts and gateways; unused ports closed
[ ] Remote-access tools inventoried; unsanctioned ScreenConnect, AnyDesk, TeamViewer removed
[ ] Defender Tamper Protection on; ASR rules in block mode after audit
[ ] DCSync monitoring on domain controllers; replication rights limited
[ ] External Teams chats restricted; mail-flooding alerts on; help desk verifies callers
[ ] No unreviewed new accounts in admin groups in the last 14 days

Verify after deployment. Over 14 days, confirm Q1, Q3 and Q10 stay silent, that no VPN login succeeds without MFA, that Veeam is not reachable from the internet, and that ASR audit events show no unexplained blocks before moving to block mode.

Each step carries its prerequisites, reboot requirement and rollback. Replace every REPLACE_WITH value before use, and test in non-production first.

Playbook 1 · Edge and backup exposure review (T1190, T1133; M1051, M1032, M1053)

Step 1.1 · Check edge devices, VPN MFA and Veeam exposure (read-only)

What it does: Finds unpatched edge devices, VPN groups that skip MFA, and an internet-reachable backup server. Changes are made through each vendor's console after this review.

Prerequisites: Console or CLI access to the firewalls and the Veeam server; the vendor advisories for the five CVEs.

Reboot required: No. These commands only read state.

Configuration

# Cisco ASA / FTD
show version | include Software
# FortiGate (example)
get system status
show user group
show vpn ssl settings
# SonicWall: System > Status, then compare the firmware to the vendor advisory
# Veeam server
(Get-Item 'C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Core.dll').VersionInfo.FileVersion
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in 9392,9401,6160,6162 } | Select-Object LocalAddress, LocalPort

Verify

# Expected: firmware at or above the vendor fix for each CVE; every VPN user group has an MFA rule;
# Veeam ports listen only on the management network and are not published to the internet.

Rollback

none required: read-only checks. Any change you make afterward needs its own backup of the device configuration.

Playbook 2 · Attack Surface Reduction rules (T1003.001, T1569.002, T1486; M1040, M1043)

Step 2.1 · Enable three ASR rules in audit mode

What it does: Logs what each rule would block without stopping anything. Covers LSASS credential theft, PsExec and WMI process creation, and ransomware behavior.

Prerequisites: Microsoft Defender Antivirus in active mode; Windows 10 1709 or later or Windows Server 2016 or later. The PsExec and WMI rule is not compatible with managing devices through Configuration Manager.

Reboot required: No.

Configuration

$ids = @('9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2','D1E49AAC-8F56-4280-B9BA-993A6D77406C','C1DB55AB-C21A-4637-BB3F-A12568109D35')
Add-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions AuditMode,AuditMode,AuditMode

Verify

$p = Get-MpPreference
for ($i=0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) { '{0} -> {1}' -f $p.AttackSurfaceReductionRules_Ids[$i], $p.AttackSurfaceReductionRules_Actions[$i] }
# 2 = Audit, 1 = Block
# Review Event ID 1122 in Microsoft-Windows-Windows Defender/Operational for 14 days

Rollback

Remove-MpPreference -AttackSurfaceReductionRules_Ids $ids

Step 2.2 · Move the three rules to block after a clean audit period

What it does: Turns audit into enforcement once the audit log shows no legitimate tool would be stopped.

Prerequisites: 14 days of audit data reviewed; exclusions added for any legitimate tool the audit flagged.

Reboot required: No.

Configuration

Add-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled

Verify

$p = Get-MpPreference
for ($i=0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) { '{0} -> {1}' -f $p.AttackSurfaceReductionRules_Ids[$i], $p.AttackSurfaceReductionRules_Actions[$i] }
# Expect 1 (Block) for all three; Event ID 1121 records blocks

Rollback

Add-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions AuditMode,AuditMode,AuditMode

Playbook 3 · Restrict RDP (T1021.001; M1035, M1030)

Step 3.1 · Scope the Remote Desktop firewall rules to jump hosts

What it does: Allows inbound RDP only from your jump hosts and gateways, which stops RDP fan-out between ordinary hosts.

Prerequisites: Jump-host addresses identified; a pilot server; console access in case you lock yourself out.

Reboot required: No.

Configuration

Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Set-NetFirewallRule -RemoteAddress 'REPLACE_WITH_JUMP_HOST_CIDR'

Verify

Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Get-NetFirewallAddressFilter | Select-Object InstanceID, RemoteAddress
# From a non-jump host, an RDP attempt to this server should time out

Rollback

Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Set-NetFirewallRule -RemoteAddress Any

Playbook 4 · Defender Tamper Protection (T1685; M1038)

Step 4.1 · Confirm Tamper Protection and audit Defender exclusions

What it does: Confirms attackers cannot switch Defender off from the command line, and lists exclusions that would let tools hide.

Prerequisites: Microsoft Defender portal or Intune access to enable the setting; enabling it is a portal or policy action, not a local command.

Reboot required: No.

Configuration

# Enable in the Microsoft Defender portal: Settings > Endpoints > Advanced features > Tamper protection,
# or through an Intune endpoint-security policy. Then verify on a host:
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, IsTamperProtected
(Get-MpPreference).ExclusionPath

Verify

# Expect IsTamperProtected = True and no exclusion paths you did not approve

Rollback

# Turn Tamper Protection off again in the same portal setting only if it blocks a required management action;
# record the reason and a review date.

Playbook 5 · Remote-access tool inventory (T1219; M1038, M1042)

Step 5.1 · Inventory ScreenConnect, AnyDesk and TeamViewer (read-only)

What it does: Builds the allowlist Q12 needs: which hosts run which remote-access tools, and which ScreenConnect instances exist.

Prerequisites: Local administrator or an endpoint-management tool to run it fleet-wide.

Reboot required: No.

Configuration

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -match 'ScreenConnect|AnyDesk|TeamViewer' } |
  Select-Object DisplayName, DisplayVersion, InstallDate
Get-Service | Where-Object { $_.DisplayName -match 'ScreenConnect|AnyDesk|TeamViewer' } | Select-Object Name, DisplayName, Status, StartType

Verify

# Compare the output with the sanctioned list. Anything else is an investigation lead.

Rollback

none required: read-only inventory.

Playbook 6 · Administrator password and lockout policy (T1110, T1078; M1027)

Step 6.1 · Apply a fine-grained policy to Domain Admins

What it does: Sets 15-character passwords and failed-login lockout for the accounts SafePay most wants, as CISA recommends.

Prerequisites: Domain functional level 2008 or later; a documented break-glass account that is excluded; a plan for service accounts, which must not be locked out by guessing.

Reboot required: No.

Configuration

New-ADFineGrainedPasswordPolicy -Name 'HuntPack-Admins-15' -Precedence 10 -MinPasswordLength 15 -ComplexityEnabled $true -LockoutThreshold 5 -LockoutDuration 00:30:00 -LockoutObservationWindow 00:30:00 -MinPasswordAge 1.00:00:00 -MaxPasswordAge 365.00:00:00 -PasswordHistoryCount 24
Add-ADFineGrainedPasswordPolicySubject -Identity 'HuntPack-Admins-15' -Subjects 'Domain Admins'

Verify

Get-ADFineGrainedPasswordPolicy 'HuntPack-Admins-15' | Select-Object Name, MinPasswordLength, LockoutThreshold
Get-ADUserResultantPasswordPolicy -Identity REPLACE_WITH_ADMIN_USER | Select-Object MinPasswordLength, LockoutThreshold

Rollback

Remove-ADFineGrainedPasswordPolicySubject -Identity 'HuntPack-Admins-15' -Subjects 'Domain Admins' -Confirm:$false
Remove-ADFineGrainedPasswordPolicy -Identity 'HuntPack-Admins-15' -Confirm:$false

The phases follow the incident-response and mitigation sections of AA26-293A (source 1).

Gaps. Initial access is outside endpoint telemetry: firewall exploitation, VPN logins without MFA, and the email and Teams lure need the native checks N1 to N3 and N5. OneDrive exfiltration needs cloud audit logs. Backup-system resets need Veeam and storage logs (N6).

Validation. Run Section 11 before promoting: telemetry ready, 14-day baseline, safe positive tests, then staged promotion.