Context: SafePay advisory AA26-293A. The IOCs cover Nov 2024 to Aug 2026; load the STIX JSON first.

1. Edge and VPN auth: Cisco ASA/FTD and SonicWall VPN logins from Mullvad exit nodes, bursts of failed logins against VPN groups (the CVE-2023-20269 brute-force pattern), and successful logins for accounts that had just failed many times. On Veeam B&R, look for unexpected connections to TCP 9401 from outside the backup network.
2. New or elevated accounts: Windows 4720/4728/4732/4756 events (account created, added to privileged groups) outside change windows, and 4724 password resets by an admin on many users within minutes (the lock-out step).
3. Discovery: PowerShell script-block logs (4104) containing Invoke-ShareFinder or ShareFinder, execution of SharpShares.exe or NetExec/nxc, and one host touching \\*\C$/ADMIN$ on many servers.
4. Lateral movement: PSEXESVC service installs (7045), wsmprovhost.exe spawning cmd/powershell, and new AnyDesk, TeamViewer or ScreenConnect installs on servers.
5. Staging and exfil: rclone.exe (or a renamed binary with rclone command-line flags like copy, --transfers, mega:), b2.exe (Backblaze), WinSCP or FileZilla on servers, and large 7-Zip/WinRAR split archives (-v volume switches) in temp or share roots. Check egress for large uploads to Mega, Backblaze B2 or OneDrive from servers.
6. Backup sabotage: vssadmin delete shadows, wmic shadowcopy delete, net stop VSS, and NAS admin logs (Synology, QNAP and others) showing reset-to-factory or volume deletion. Any admin login to the backup NAS from a Windows workstation is worth a look.
7. Impact: files renamed to .SafePay, ransom notes on desktops or drive roots, and the encryptor deleting itself.
8. IOC caution: 104.26.2[.]223 (Cloudflare), 140.82.114[.]4 and 185.199.108[.]133 (GitHub) and 173.194.194[.]94 (Google) are shared infrastructure, so match them only together with process or user context. 167.235.225[.]149 (login panels), 5.255.11[.]134 and 37.10.71[.]188 (exfiltration) and 88.119.167[.]239 (soc.dll C2) are better standalone leads.