Security Advisory

What is SafePay Ransomware?

Read Time 4 mins | 28 April 2025

For Australian businesses, SafePay ransomware highlights the growing cyber threats that put sensitive data and businesses at risk. As a company committed to safeguarding organisations, we at Rivanorth have seen the devastating impact of such attacks. SafePay ransomware, with its sophisticated methods and aggressive tactics, has quickly become a notable concern. This article dives into what SafePay ransomware is, how it operates, and actionable steps Australian businesses can take to protect themselves from this growing threat.

Defining SafePay Ransomware

SafePay is a type of ransomware, a malicious software that encrypts a victim’s files, rendering them inaccessible until a ransom is paid. First identified in November 2024, SafePay is a relatively new but active player in the cybercrime landscape. It appends the “.safepay” extension to encrypted files and drops a ransom note named “readme_safepay.txt” or “readme_safepay_ascii.txt” on compromised systems. The note typically outlines the attack, demands payment, and provides instructions for contacting the attackers, often via dark web channels. SafePay has claimed responsibility for attacks on various organisations worldwide, including Australian businesses like Brighton Australia.

How SafePay Ransomware Operates

SafePay ransomware is designed to infiltrate, disrupt, and extort, using a combination of advanced techniques and opportunistic strategies. Its operational methods are particularly concerning for businesses with complex IT environments. Here’s a detailed look at how SafePay works:

  • Initial Access via Exploited Vulnerabilities: SafePay often enters systems through security misconfigurations, such as unpatched software, outdated firewalls, or poorly secured remote desktop protocols (RDP). Its ransom notes frequently highlight “security misconfigurations” as the entry point, exploiting gaps that businesses may overlook.
  • Leveraging LockBit Builder: SafePay is built on a modified version of the LockBit ransomware builder, a tool available in the Ransomware-as-a-Service (RaaS) ecosystem. This allows SafePay to encrypt files rapidly while incorporating evasion techniques to bypass antivirus software and endpoint detection systems.
  • Data Exfiltration and Double Extortion: SafePay doesn’t just lock files; it steals sensitive data, such as customer records, financial details, or intellectual property. Attackers then threaten to leak or sell this data on dark web marketplaces if the ransom isn’t paid, creating a double-extortion scenario that heightens pressure on victims.
  • Advanced Evasion Techniques: SafePay employs sophisticated methods to avoid detection, including Living-off-the-Land Binaries (LOLBin), which use legitimate system tools to execute malicious actions. It also bypasses User Account Control (UAC) to gain elevated privileges and deletes shadow copies to prevent data recovery without payment.
  • Targeted Attack Patterns: SafePay tailors its attacks to specific industries, such as construction, education, and mining. For instance, in March 2025, it claimed to have stolen over 160 gigabytes of data from Brighton Australia, a Sydney-based contractor, demonstrating its focus on high-value targets.
  • Ransom Communication: After encryption, SafePay provides a ransom note with a Tor-based link or email for negotiation. The group is known for setting tight deadlines, increasing urgency and exploiting victims’ fear of data leaks or operational downtime.

These tactics make SafePay a formidable threat, capable of causing significant disruption and financial loss if not addressed promptly.

The Impact on Australian Businesses

SafePay ransomware poses significant risks to Australian organisations, particularly small and medium-sized enterprises that may lack robust cybersecurity measures. The consequences of an attack include:

  • Financial Losses: Ransom demands, downtime, and recovery costs can be substantial. The average ransomware attack cost organisations $9.36 million in 2024.
  • Reputational Damage: Data leaks can erode customer trust and harm brand credibility.
  • Operational Disruption: Encrypted systems can halt business operations, leading to delays and lost revenue.
  • Regulatory Penalties: Under Australia’s Notifiable Data Breaches (NDB) scheme, businesses must report significant breaches, and non-compliance can result in fines.

Given SafePay’s focus on exploiting misconfigurations, Australian businesses must prioritise proactive dark web monitoring and cybersecurity audits to mitigate these risks.

Protect Your Business with Oko - The Dark Web Monitoring Solution

To combat threats like SafePay ransomware, Australian businesses need advanced tools to detect and respond to cyber risks. Oko, developed by Rivanorth, is an AI-driven dark web monitoring solution tailored for the Australian market. Oko provides:

  • Real-Time Dark Web Scanning: Identifies stolen credentials, customer data, or proprietary information before they’re exploited.
  • Threat Intelligence: Delivers actionable insights to address vulnerabilities and prevent attacks.
  • Compliance Support: Helps businesses meet NDB scheme requirements by detecting and reporting data leaks promptly.

By integrating Oko into your cybersecurity strategy, you can stay one step ahead of ransomware groups like SafePay. Visit rivanorth.com to learn how Oko can safeguard your organisation.

Steps to Prevent SafePay Ransomware Attacks

Preventing SafePay ransomware requires a multi-layered cybersecurity approach. Australian businesses should consider the following measures:

  • Patch and Update Systems: Regularly update software and systems to close vulnerabilities that SafePay exploits.
  • Implement Multi-Factor Authentication (MFA): MFA adds a layer of security, making it harder for attackers to use stolen credentials.
  • Conduct Employee Training: Educate staff on recognising phishing emails and other social engineering tactics used by ransomware groups.
  • Backup Data Regularly: Maintain secure, offline backups to restore data without paying a ransom.
  • Engage Dark Web Monitoring: Use tools like Oko to detect exposed data early and respond before cybercriminals act.

Additionally, businesses should develop an incident response plan to handle ransomware attacks efficiently, minimising downtime and damage.

Conclusion

SafePay ransomware is a serious threat to Australian businesses, leveraging advanced techniques and double-extortion tactics to maximise harm. By understanding how SafePay operates and implementing robust cybersecurity measures, organisations can reduce their risk of falling victim. Proactive dark web monitoring with solutions like Oko is critical to detecting threats early and maintaining compliance with Australian regulations. Act now to protect your business from SafePay and other cyber threats—your data and reputation depend on it.