---
title: Hunt: SafePay ransomware precursors from AA26-293A: VPN logins from Mullvad, ShareFinder/SharpShares, rclone or b2.exe exfil, VSS stops and NAS factory resets | ctxsec
url: https://ctxsec.com/items/hunt-safepay-aa26-293a
description: "Hunt ideas built from the SafePay joint advisory: VPN and edge auth anomalies, share enumeration, archive-and-exfil tooling, backup sabotage and the advisory's IOCs (several are shared infrastructure, so check them first)."
status: "hunt idea (from AA26-293A)"
published: 2026-10-20
---

> Hunt ideas built from the SafePay joint advisory: VPN and edge auth anomalies, share enumeration, archive-and-exfil tooling, backup sabotage and the advisory's IOCs (several are shared infrastructure, so check them first).

[← Threat Hunting](/hunting) · [markdown](/items/hunt-safepay-aa26-293a.md)

hunt idea (from AA26-293A)

2026-10-20

### Hunt: SafePay ransomware precursors from AA26-293A: VPN logins from Mullvad, ShareFinder/SharpShares, rclone or b2.exe exfil, VSS stops and NAS factory resets

Context: [SafePay advisory AA26-293A](/news#aa26-293a-safepay-ransomware). The IOCs cover Nov 2024 to Aug 2026; load the [STIX JSON](https://www.cisa.gov/sites/default/files/2026-10/AA26-293A-stix.json) first.

1. **Edge and VPN auth:** Cisco ASA/FTD and SonicWall VPN logins from Mullvad exit nodes, bursts of failed logins against VPN groups (the CVE-2023-20269 brute-force pattern), and successful logins for accounts that had just failed many times. On Veeam B&R, look for unexpected connections to TCP 9401 from outside the backup network.
2. **New or elevated accounts:** Windows 4720/4728/4732/4756 events (account created, added to privileged groups) outside change windows, and 4724 password resets by an admin on many users within minutes (the lock-out step).
3. **Discovery:** PowerShell script-block logs (4104) containing `Invoke-ShareFinder` or `ShareFinder`, execution of `SharpShares.exe` or `NetExec`/`nxc`, and one host touching `\\*\C$`/`ADMIN$` on many servers.
4. **Lateral movement:** PSEXESVC service installs (7045), `wsmprovhost.exe` spawning `cmd`/`powershell`, and new AnyDesk, TeamViewer or ScreenConnect installs on servers.
5. **Staging and exfil:** `rclone.exe` (or a renamed binary with rclone command-line flags like `copy`, `--transfers`, `mega:`), `b2.exe` (Backblaze), WinSCP or FileZilla on servers, and large 7-Zip/WinRAR split archives (`-v` volume switches) in temp or share roots. Check egress for large uploads to Mega, Backblaze B2 or OneDrive from servers.
6. **Backup sabotage:** `vssadmin delete shadows`, `wmic shadowcopy delete`, `net stop VSS`, and NAS admin logs (Synology, QNAP and others) showing reset-to-factory or volume deletion. Any admin login to the backup NAS from a Windows workstation is worth a look.
7. **Impact:** files renamed to `.SafePay`, ransom notes on desktops or drive roots, and the encryptor deleting itself.
8. **IOC caution:** 104.26.2[.]223 (Cloudflare), 140.82.114[.]4 and 185.199.108[.]133 (GitHub) and 173.194.194[.]94 (Google) are shared infrastructure, so match them only together with process or user context. 167.235.225[.]149 (login panels), 5.255.11[.]134 and 37.10.71[.]188 (exfiltration) and 88.119.167[.]239 (`soc.dll` C2) are better standalone leads.

Sources: [CISA AA26-293A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a) · [AA26-293A STIX JSON](https://www.cisa.gov/sites/default/files/2026-10/AA26-293A-stix.json)