Astaroth malware attacks SafePay via Brazilian financial networks daily

In August 2024, the SafePay ransomware group began highly active operations targeting businesses and critical infrastructure across North America, South America, Europe, Australia, and Brazil. The attackers typically gain access by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. Astaroth malware is used as a payload, deployed on victim devices through infection chains that start with Eternidade Stealer campaigns. SafePay actors have been active since then, targeting finance sector organizations across multiple regions including LATAM, NORTH_AMERICA, EUROPE, and AUSTRALIA. The attackers use various tactics such as domain, pcap, url, zip archive, startup folder, autoit script, delphi payload, extracted x86, delphi loader, add0x2a to infect devices.