SafePay Hits 600 Victims, Expands into LATAM

Context and background

SafePay appears in the material reviewed as an active ransomware operation since August 2024. That timeline does not come from a single source, but from the joint advisory AA26-293A published on October 20, 2026 by CISA, the FBI, the U.S. Secret Service, the Rhineland-Palatinate State Criminal Police Office, the UK National Crime Agency, and the North West Regional Organised Crime Unit. The document establishes a clear baseline for the timeline: sustained activity, multinational reach and at least 600 victims.

The same advisory matters because it sets the limits of what can be said with confidence. It refers to North America, South America, Europe and Australia, but it does not break the damage down by region or identify specific Latin American victims. In other words, it confirms that Latin America is within the blast radius, but it does not allow an official inventory of affected organizations by country. Anything beyond that, including leak-site claims, should be treated as third-party attribution or as the group’s own accusation.

The second pillar of the context is technical. CISA published IOCs observed between November 2024 and August 2026, along with hashes, files, hostnames and IPs. The advisory also notes that some names point to legitimate tools, so the mere presence of a file is not enough to block it without contextual verification. That matches a common ransomware pattern, where administrative and file-transfer tools are blended with malicious artifacts to move without triggering early alerts.

Third-party sources add two more layers of interpretation. First, several analysts point to code overlap between SafePay and LockBit 3.0 or LockBit Black, especially in command-line parameters, encryption logic and compilation artifacts. Second, leak-intelligence sites show claims involving Latin American organizations, including anwo.cl in Chile and auromex.com in Mexico. None of those posts, by itself, equals forensic confirmation of compromise, but they do help frame the group’s public exposure in the region.

Key facts table

Operation timeline

Attack chain and TTPs

SafePay follows an intrusion chain that combines opportunistic initial access, operational escalation, exfiltration and double extortion. The advisory is explicit that the actors do not rely on a single technical entry point. They can start with stolen or guessed credentials, brute force, phishing, VPN abuse or exploitation of Internet-facing systems. That range helps explain why the campaign can appear in very different organizations and in separate geographies.

Once inside, the operators try to keep the session alive and move with legitimate tools. CISA documents the creation or modification of administrative accounts, the use of PsExec, WinRM, RDP and remote administration software, as well as resource enumeration with ShareFinder.ps1 and SharpShares.exe. It also notes defense disabling, password changes, UAC bypass and token impersonation. The activity points to a manual or semi-manual intrusion, not a random automated encryption run.

In the information theft phase, the group uses common utilities to avoid drawing attention. FileZilla, 7-Zip, RClone, WinRAR, WinSCP and OneDrive appear as collection and transfer mechanisms. In some cases, Backblaze was also observed. These tools are not exotic, which is exactly why signature-only detection is harder: many are part of legitimate admin or backup workflows. The difference lies in context, sequence and their combination with other artifacts.

The final stage mixes technical and psychological pressure. Before encryption, the operators stop Volume Shadow Copy Service and can reset NAS devices that hold backup copies. They then encrypt with ChaCha20 and RSA, usually append the .SafePay extension and apply a double-extortion scheme. The ransom note points to a Tor portal, includes a victim identifier and is often followed by phone calls from a representative. If the victim does not pay, the data is published on the leak site. In parallel, sources such as AttackIQ and SafeBreach add persistence or credential-theft tools that broaden the picture, although those observations should still be read as third-party analysis rather than additional official confirmation.

Documented TTPs from CISA

Observed initial vectors and vulnerabilities

CISA identifies five CVEs associated with the observed initial access: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. In supplemental sources, CVE-2023-20269 is linked to Cisco ASA/FTD remote access VPN, and CVE-2023-27532 to Veeam, where it can be used to extract encrypted credentials from the configuration database and reach backup infrastructure. Brandefense adds that CVE-2024-40711 also belongs to Veeam Backup & Replication and CVE-2024-40766 to SonicWall SonicOS.

The important point is not only the CVE list, but the selection logic. The attackers appear to target surfaces widely used in enterprise environments, especially remote access and backup. If an organization exposes VPN, manages remote backups or keeps services published to the Internet, SafePay’s operational value rises. That pattern fits the interest in credentials, remote access and administration tools described in the advisory.

Note on similarities with LockBit

Several third-party sources report overlap between SafePay and LockBit 3.0 or LockBit Black, especially in command-line parameters, compilation artifacts and encryption logic. That detail is useful for technical investigation, but it does not justify automatic attribution. The available material presents it as reverse-engineering analysis or code overlap, not as evidence that SafePay is operated by LockBit. That distinction should remain intact in any regional or sectoral reading.

Regional impact

SafePay has a confirmed regional footprint in Latin America, but the level of certainty varies widely between the advisory’s aggregated scope and specific leak-site claims. CISA confirms South America within the impact radius, while Cyble adds countries in Central America, South America, the Caribbean and North America to its tracking of the actor. Even so, the official document does not publish a list of Latin American victims or attribution by country, so any regional reading must separate operational reach, public claims and independent confirmation.

Regional overview

The regional picture is that of a transnational campaign with verified effects on multiple continents and public signs of activity in Latin America. CISA reports at least 600 separate victims and confirms South America within the scope. Cyble also includes Argentina, Chile, Colombia, Peru, Paraguay, Guatemala, El Salvador, Mexico, Puerto Rico, Bermuda, Barbados, Jamaica and Curaçao in its SafePay tracking. That does not make all of those countries confirmed victims, but it does show sustained regional claims and observation.

The operational implication is clear. Campaigns like this do not need a single vector or a single geography. They can enter through VPN, leaked credentials, phishing or exploitation of exposed services, then rely on legitimate tools to move, exfiltrate and encrypt. In Latin America, that makes controls around remote access, backups, segmentation and compromised-account response especially important. It also means leak-site indexing should not be trusted without independent corroboration.

Argentina

Argentina appears in Cyble’s tracking as one of the countries associated with SafePay, but the official material does not identify a specific Argentine victim. CISA also provides no national breakdown within South America. The result is that only one thing can be stated with confidence today: Argentina is included in the set of countries monitored by third parties and within the broader regional scope confirmed by the advisory, not that a specific Argentine organization has been verified as breached.

The material does, however, show what defenders in the country should look for if they suspect compromise. Observed vectors include phishing, VPN abuse, CVE exploitation, lateral movement with PsExec, WinRM and RDP, share enumeration with ShareFinder.ps1 and SharpShares.exe, and exfiltration with RClone, WinSCP or OneDrive. Those behaviors are general to the operation, not proof of an identified Argentine case.

Chile

Chile is more visible because of the public claims around anwo.cl, but the evidentiary status is still the same: a claim by the group, not independent forensic confirmation. Recent Breaches, Ransomware.live, Dark Eye and DeXpose index the publication as attributed to SafePay, and some of those sources add sector context such as HVAC or services. None of them, by themselves, prove the intrusion, exfiltration or encryption.

For Chile, then, there is a basic difference between a claim and confirmed evidence. CISA does not mention the country or tie a concrete incident to a Chilean victim. It does, however, detail the pattern that could have preceded a real compromise, from credentials and VPN through exfiltration and double extortion. From a monitoring standpoint, the Chile case should be read as an exposure warning, not as a closed attribution.

Mexico

Mexico appears on two different levels. Security Arsenal logged a SafePay post for auromex.com, classified as a manufacturing organization, and noted that it was the only entry with the MX country code in that batch of nine claims. CISA, for its part, confirms North America within the scope but does not break out Mexican victims or link the observed vectors to auromex.com or any other entity in the country.

That leaves a situation similar to Chile, although with a different source base. Here there is not only a leak-site indexer, but also a sector observation from Security Arsenal. Even so, that source makes clear that the corroboration shows the group published the allegations, not that the organizations were compromised. The analytical value lies in the actor’s apparent interest in Mexican manufacturing, not in a confirmed intrusion.

United States

The United States appears with greater documentary density because several third-party sources and the advisory itself broaden the view of the aggregate impact. CISA confirms that North America is within scope, and Dark Web Sonar estimates, based on leak-site listings, a significant presence of U.S. organizations among SafePay’s publications. Even so, the advisory does not reconstruct an official victim list for the United States or provide a country-only count.

For regional analysis, that matters for two reasons. First, it suggests the operation left broad marks in large corporate and critical infrastructure environments. Second, it reinforces the need for methodological caution: even when there are hundreds of claims, that does not equal hundreds of confirmed compromises. The official material still draws the geographic boundaries well, but it does not resolve individual attribution for each leak-site entry.

Countries without additional verifiable coverage

There are no additional verifiable facts in the research for Paraguay, Bolivia, Peru, Colombia, Brazil and Uruguay beyond the advisory’s regional scope and third-party tracking lists.

Technical indicators

CISA publishes IOCs observed between November 2024 and August 2026. The advisory itself notes that some files and tools are legitimate, so the defensive response should be contextual rather than based on automatic blocking alone. At this stage, the official list is useful for hunting, correlation and triage, not for mechanical decisions without environment validation.

Table of IOCs published by CISA

Associated infrastructure and tools

The advisory also associates 88.119.167[.]239 with soc.dll, 5.255.11[.]134 and 37.10.71[.]188 with exfiltration, 173.194.194[.]94 with victim data hosting and 167.235.225[.]149 with customer login panels. It also mentions OneDrive, Backblaze B2, a Tor negotiation portal and SafePay’s leak site. Technical artifacts include nxc.exe, netscan.exe, nltest.exe, Socks.exe, Socks_werfault.exe and b2.exe. Together, these details reinforce a mixed operational ecosystem, where private infrastructure, commercial service accounts and reused admin utilities coexist.