SafePay and Aur0ra hit Argentina

Aur0ra recorded victims in Argentina and Peru. Its analysis describes a double-extortion scheme that began with access through misconfigured VPN portals, single-factor RDP endpoints, and vulnerable edge appliances. At the same time, SafePay was included in a joint advisory from CISA, the FBI, the U.S. Secret Service, and law enforcement agencies in Germany and the United Kingdom, which attributes at least 600 affected organizations since August 2024 and cites South America in third-party tracking.

What was observed in Aur0ra?

Aur0ra combined initial intrusion through weak perimeter exposure with lateral movement using built-in admin tools, PowerShell, and Mimikatz. It then searched for shared resources, repositories, and backups. According to Ransom-DB, it later compressed and exfiltrated the data using legitimate sync tools or encrypted C2 tunnels, and published it afterward on a Tor leak site.

Ransom-DB’s review also places Aur0ra across specific sectors, including commercial manufacturing, legal services, diagnostic healthcare, hospitality, and architectural engineering. In other words, this was not a pattern concentrated in a single vertical, but a campaign that reached organizations with different profiles.

How does SafePay fit into the regional picture?

SafePay appears in a joint advisory that speaks of more than 600 affected organizations and links the group to a double-extortion technique, while also stressing basic hardening steps. The advisory focuses on patching exploited vulnerabilities, mandatory MFA, offline and immutable backups, network segmentation, and monitoring for lateral movement.

MedRisk’s coverage adds that Argentina, Chile, Colombia, Peru, and other Latin American countries appear in third-party tracking related to SafePay, but notes that the official advisory does not confirm specific victims or provide a country-by-country breakdown. That leaves two separate layers: a formal warning with global scope and a regional attribution that remains officially unconfirmed.

What regional data is confirmed?

What can be verified is that Aur0ra has already left victims in Argentina and Peru, and that SafePay was the subject of a joint warning over its impact on at least 600 organizations since August 2024. There is also a 2025 reference in FortiRecon, which reported 141 confirmed victims in Brazil, 69 in Mexico, 50 in Argentina, and 41 in Colombia, although that data is not tied in the material to a single ransomware family.

The picture left by the reports is one of active campaigns with regional reach and TTPs that exploit remote access flaws, exposed devices, and weak credentials. In SafePay’s case, country-level attribution remains open in the available information. For Aur0ra, Argentina and Peru are already listed as confirmed victims.