ANWO and SafePay Leak Tied to Global Alert

SafePay later published files attributed to ANWO, including severance records with names, RUT numbers and signatures, as well as labor contracts and documents about termination reasons, according to a source cited by Newschu. That disclosure comes amid an extortion campaign that, according to a joint alert from CISA, the FBI and partner agencies, has reached at least 600 victims since August 2024 across critical infrastructure organizations in North America, South America, Europe and Australia.

What is known about the leak attributed to ANWO?

According to available coverage, SafePay circulated documents attributed to ANWO, but that attribution has not been officially confirmed. The source cited by Newschu refers to severance records containing personal data and signatures, along with labor contracts and paperwork tied to termination reasons.

That material broadens the potential scope of the exposure, because it does not appear to be limited to general corporate information. The presence of names, RUT numbers and signatures in the severance records raises the sensitivity of the leaked content, although the available report does not show public confirmation from ANWO or from a Chilean agency.

What does the international alert say about SafePay?

The joint alert from CISA, the FBI and partner agencies attributes at least 600 victims to SafePay since August 2024. The warning has a global reach and covers critical infrastructure organizations in North America, South America, Europe and Australia, but it does not identify ANWO or confirm any specific victim in Chile.

The technical analysis tied to that alert describes a consistent pattern. Operators typically get in with compromised credentials and by abusing known vulnerabilities in internet-facing perimeter devices, including VPN-connected equipment. Mallory.ai adds that stolen credentials are also used, or credentials obtained through phishing, password guessing and exploitation of VPNs or other exposed services.

How does the group operate, according to technical analyses?

The campaign relies on double extortion and combines several pressure tactics. Cyber Threat describes a negotiation portal on Tor, phone calls made in the group’s name and data publication when no deal is reached.

Mallory.ai adds that after initial access, SafePay uses legitimate tools for lateral movement and data theft. That detail matches the pattern described in alerts about the group, where the intrusion is paired with exfiltration and negotiation mechanisms designed to force payment.