SafePay Ransomware Decryption & Data Recovery

SafePay was first observed in September-October 2024 and launched its leak site that November. Unlike mainstream ransomware-as-a-service, it is a closed operation: no affiliate recruitment, no encryptor rental, with the same core team handling access, deployment and negotiation. That structure gives it highly consistent tradecraft and a fast tempo - multiple analyses note SafePay completing the path from intrusion to encryption within hours.

Its growth rate stands out most. Through 2025 SafePay claimed more than 270 victims, peaking at 73 in a single month. By September 2026 its leak site listed roughly 560 claimed victims, with 13 added in the preceding 30 days. Victims still cluster in the United States (~212) and Germany (~126) but now extend to Spain, Italy, Portugal, Austria, Argentina, the Philippines and South Korea, across manufacturing, healthcare, construction, education, research, government and IT services, mostly mid-size businesses and groups.

The defining incident was the July 2025 attack on global IT distributor Ingram Micro: internal systems went down broadly, ordering platforms and distribution operations were affected worldwide, and public reporting traced the entry point to its GlobalProtect VPN gateway. That case also highlights SafePay's preference for MSPs, IT distributors and service providers - one breach reaches a long chain of downstream customers.

Technically, SafePay's code overlaps heavily with the LockBit 3.0 (LockBit Black) build leaked in 2022, with fragments resembling ALPHV/BlackCat and INC Ransom, making it a classically assembled payload. The lesson for Chinese enterprises is direct: SafePay's main entry is valid credentials and password spraying against VPN gateways, and SSL VPN deployments in China commonly share exactly that exposure - weak passwords, MFA not enabled, and departed employees' accounts left active. No public report confirms a targeted SafePay campaign against mainland China organisations.

Extension. .safepay is appended to encrypted files.

Ransom note. readme_safepay.txt is dropped in each encrypted directory. The English text carries a victim-specific ID and a Tor negotiation portal address and states that data has been encrypted and exfiltrated.

Intrusion and deployment indicators.

• Successful VPN gateway logins (GlobalProtect-class SSL VPN, for example) from unfamiliar regions or at odd hours, or a success following heavy password spraying failures.
• Endpoint protection disabled or uninstalled and security services stopped.
• Volume shadow copies deleted and logs cleared.
• In some cases encryption executed through safe mode or a specific boot configuration to evade protection.
• Before exfiltration, WinRAR staging and FileZilla transfers, and abuse of cloud sync channels such as OneDrive so the outbound traffic resembles normal business activity.

Pressure tactics. SafePay pairs email bombing - flooding a mailbox with junk in a short window - with phone calls impersonating IT support, used both to socially engineer access and to apply pressure after encryption. An IT team suddenly receiving mass junk mail while fielding "IT support" calls should treat it as a high-risk signal.

Attribution note. Because the code overlaps heavily with LockBit 3.0, behaviour alone is easy to confuse with LockBit-lineage payloads; accurate identification requires comparing encrypted-file structure and binary fingerprints.

SafePay's access is unusually concentrated - nearly every public case points to the same category of entry:

• Valid credentials on VPN gateways. Accounts bought on dark-web markets, harvested from infostealer logs or obtained by password spraying are used to log straight into the network over VPN. This is its primary vector, and the Ingram Micro incident was reported as entering via the VPN gateway.
• Password spraying and brute force. Aimed at remote entry points without MFA or login rate limiting.
• VPN and edge device vulnerabilities. Exploitation of unpatched remote access appliances.
• Social engineering. Email bombing combined with phone calls impersonating IT support to get staff to install a remote management tool that admits the attacker.
• Lateral movement. Valid credentials used over RDP and administrative channels toward file servers, database servers, the virtualisation platform and backup systems.
• Defence evasion. Endpoint protection disabled, security services stopped, shadow copies deleted and logs cleared.
• Exfiltration. WinRAR staging with FileZilla transfer, or cloud sync channels such as OneDrive, making outbound traffic hard to distinguish from normal activity.
• Rapid deployment. Because one team runs the whole chain, the window from entry to full encryption is often very short, leaving defenders little reaction time.

For Chinese organisations the three highest-yield defences are: enforce MFA on VPN, promptly remove departed and dormant accounts, and alert on geographic and time anomalies in VPN logins.

Algorithms. SafePay encrypts content with ChaCha20, generating a unique symmetric key per file protected by an asymmetric key embedded in the encryptor. Without the operators' private key nothing can be reversed, and public analysis reports no exploitable flaw.

Code lineage. Heavy overlap with the LockBit 3.0 (LockBit Black) code leaked in 2022, plus fragments resembling ALPHV/BlackCat and INC Ransom. Shared code does not mean shared keys - historical LockBit decryption approaches do not apply to SafePay.

Recovery inhibition. Volume shadow copies deleted, security and backup services stopped and event logs cleared, with some cases executing encryption after a safe-mode boot to evade endpoint protection.

Virtualisation scope. Public analysis as of May 2025 found no confirmed standalone VMware ESXi encryptor; the encryptor is a Windows build. That does not make virtualised environments safe: virtual machine files stored on an encrypted Windows or Hyper-V host, or on reachable shares and storage, are encrypted alongside everything else, with business impact comparable to an ESXi locker. Scope the impact from the actual samples and environment rather than relaxing hypervisor checks because no ESXi build exists.

Double extortion. Data is exfiltrated before encryption and published on the leak site if unpaid, reinforced by email bombing and phone pressure.