FBI and CISA issue joint advisory AA26-293A on SafePay ransomware campaign (22 Oct 2026)

Joint advisory AA26-293A: unmasking the SafePay ransomware syndicate

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the United Kingdom's National Cyber Security Centre (NCSC) have released Joint Cybersecurity Advisory AA26-293A warning organizations of active, high-tempo operations by the SafePay ransomware-as-a-service (RaaS) syndicate. First identified in telemetry in early 2025, SafePay has claimed at least 124 confirmed enterprise and public-sector victims across North America and Europe, with 54% of intrusions concentrated within critical infrastructure, manufacturing, and healthcare sectors.

Federal investigators report that SafePay affiliates operate with an aggressive dwell time averaging 4.8 days between initial perimeter intrusion and host encryption, with accelerated intrusions achieving complete domain-wide encryption in as few as 36 hours. Extortion demands range from $500,000 to $12,000,000 in cryptocurrency, reflecting a median demand of $3,200,000 coupled with threats of public data leaks on specialized darknet auction portals.

What this establishes from the public record. Investigators have tied 124 confirmed intrusions to a shared affiliate infrastructure utilizing Bring Your Own Vulnerable Driver (BYOVD) rootkits to disable EDR sensors. Staged exfiltration precedes encryption in 100% of reported cases, utilizing multi-threaded Rclone transfers averaging 1.2 TB per hour. What this does not establish. The advisory does not name individual affiliate identities or sovereign state sponsorship, though code similarities indicate structural lineage derived from leaked LockBit and Lynx codebases.

Attack lifecycle: perimeter exploitation to high-speed extortion

Forensic investigations across incident response engagements reveal a standardized five-phase attack progression executed by SafePay affiliates:

Affiliates establish initial persistence by exploiting unpatched edge appliances (including remote access VPNs and virtual desktop interfaces) or by deploying valid user credentials purchased from underground infostealer marketplaces. Once inside, operators deploy secondary remote monitoring and management (RMM) tools such as AnyDesk and ScreenConnect to secure redundant access channels.

Tactical execution profile: MITRE ATT&CK mapping and adversary tooling

The joint advisory details observed adversary tooling and command-line tradecraft mapped to the MITRE ATT&CK enterprise framework:

SafePay ransomware tactics, techniques, and procedures mapped to MITRE ATT&CK

Kill Chain Phase	MITRE ATT&CK ID	Observed Threat Tooling	Tactical Operational Impact
Initial Access	T1190 / T1078	Edge VPN/VDI exploits, infostealer credentials	Perimeter breach without triggering user MFA alerts
Defense Evasion	T1068 / T1562.001	BYOVD vulnerable signed kernel driver (RTCore64)	Terminates EDR sensor callbacks and security agents
Discovery and Lateral Spread	T1087 / T1021.002	SharpHound, AdFind, PsExec, Impacket	Domain admin reconnaissance and internal lateral jump
Data Exfiltration	T1567.002	Multithreaded Rclone to Mega and AWS S3	Sustained exfiltration at ~1.2 TB/hr prior to locking
Impact and Encryption	T1486 / T1490	ChaCha20 + RSA-4096, vssadmin shadow purge	Rapid host encryption at ~85 GB/hr; .safepay extension

Prior to encrypting hosts, SafePay deploys Rclone scripts configured with multi-threaded transfer flags, extracting proprietary data to cloud storage endpoints at speeds exceeding 1.2 TB per hour. Once staging is verified, the locker binary initiates hybrid ChaCha20 and RSA-4096 encryption, appending the .safepay extension and dropping extortion instructions in SafePay_ReadMe.txt.

Technical internals: BYOVD kernel manipulation and encryption mechanics

The core technical differentiator in SafePay's kill chain is its BYOVD kernel loader. Attackers drop a legitimately signed driver (typically Micro-Star RTCore64.sys, signed in 2019) to exploit unvalidated IOCTL handlers (specifically IOCTL 0x80002048 for memory reads and 0x8000204C for memory writes). By issuing read/write primitives from a user-mode helper process, the malware walks Windows kernel structures (EPROCESS) to locate running security services.

Once the target EDR process PID is identified, the driver unlinks the process from ActiveProcessLinks and zeroes out kernel callback arrays (including PspCreateProcessNotifyRoutine and ObRegisterCallbacks). This strips the security sensor of its ability to receive system event telemetry, effectively rendering it a ghost process that appears operational in Task Manager while blind to filesystem modifications.

// Structural layout of SafePay appended file trailer
struct SafePayFileFooter {
    uint8_t  magic[11];             // 'SAFEPAY_KEY'
    uint8_t  nonce[12];             // ChaCha20 96-bit nonce
    uint8_t  encrypted_key[512];    // 256-bit ChaCha20 key encrypted with RSA-4096
    uint32_t original_size_low;
    uint32_t original_size_high;
    uint32_t crc32_checksum;
};

Technical demonstration: forensic threat hunting and driver auditing

Defenders can detect SafePay operational staging and BYOVD driver loading using targeted event log queries and YARA signatures:

# 1. Detect anomalous kernel driver installation (Event ID 7045)
Get-WinEvent -FilterHashtable @{
    LogName = 'System';
    Id = 7045
} | Where-Object {
    $_.Properties[0].Value -match 'RTCore64|gdrv|ATSIV|procexp'
} | Select-Object TimeCreated, @{N='Driver';E={$_.Properties[0].Value}}, @{N='Path';E={$_.Properties[1].Value}}

# 2. Hunt for SafePay shadow copy deletion commands in Security Event ID 4688
Get-WinEvent -FilterHashtable @{
    LogName = 'Security';
    Id = 4688
} | Where-Object {
    $_.Message -match 'vssadmin.*delete.*shadows|wbadmin.*delete.*catalog|wmic.*shadowcopy.*delete'
}

rule Win64_Ransomware_SafePay_Payload {
    meta:
        description = "Detects SafePay 64-bit ransomware binaries and BYOVD helper"
        author = "P.K. Sharma Threat Research"
        reference = "CISA AA26-293A"
        date = "2026-10-22"
    strings:
        $magic_safepay = { 53 41 46 45 50 41 59 5F 4B 45 59 } // SAFEPAY_KEY
        $readme = "SafePay_ReadMe.txt" ascii wide
        $vss_cmd = "vssadmin.exe delete shadows /all /quiet" ascii wide
        $ext = ".safepay" ascii wide
        $byovd_loader = "\Device\RTCore64" ascii
    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        (3 of ($magic_safepay, $readme, $vss_cmd, $ext, $byovd_loader))
}

Primary sources review: examining the CISA and FBI joint advisory

A critical evaluation of Joint Advisory AA26-293A highlights key strengths and investigative boundaries:

• Granular Attack Surface Telemetry: The joint advisory provides exhaustive network indicators of compromise (IOCs), detailing C2 IP addresses, staging domains, and specific Rclone command-line arguments used across enterprise compromises.
• Attribution Conservatism: Federal agencies declined to formally attribute SafePay to an established threat group, characterizing it as a decentralized RaaS collective. However, forensic code overlaps strongly indicate reuse of builder modules previously seen in LockBit 3.0 and Lynx operations.
• The Dwell Time Paradox: The advisory documents a median dwell time of 4.8 days. While 4.8 days represents ample opportunity for network detection, the fact that 124 organizations failed to intercept the threat underscores how effectively BYOVD rootkits suppress endpoint detection.

From the practice: independent technical analysis and architectural verdict

The SafePay campaign demonstrates the systemic vulnerability of relying solely on user-mode and kernel-hooked EDR solutions. When an attacker achieves local administrative privilege, relying on software agents running inside the same operating system boundary creates a false sense of security.

• Enforce Hardware-Enforced Driver Blocklists: Organizations must enable Windows Defender Application Control (WDAC) with the Microsoft Vulnerable Driver Blocklist in enforced mode. Without hypervisor-protected code integrity (HVCI), any administrator can load signed vulnerable drivers and blind security agents.
• The 115-Hour Window: With a mean dwell time of 4.8 days (~115 hours), defenders have a substantial operational window to identify the intrusion during the lateral movement and staging phases. Security teams must configure immediate alerts on RMM software deployment (AnyDesk, ScreenConnect) and high-volume outbound cloud storage traffic (Rclone).
• Immutable Air-Gapped Recovery: Because SafePay systematically purges local Volume Shadow Copies and backup catalogs, enterprise recovery hinges on write-once-read-many (WORM) storage with air-gapped credentials.