Threat Intel
Akira, ReadText34, and INC Ransomware Target SafePa Payments – Immediate Defense Steps
Huntress observed Akira ransomware affiliates, ReadText34, and INC ransomware exploiting the SafePa payment platform. The attacks involve credential theft and ransomware deployment, impacting organizations that use SafePa for transactions. Defenders should audit payment logs, enforce MFA, isolate compromised endpoints, and apply the latest patches.
What Happened
Huntress detected activity from Akira ransomware affiliates, ReadText34, and INC ransomware groups targeting the SafePa payment platform. Attackers leveraged compromised credentials to gain access to transaction systems and deploy ransomware payloads.
Impact
Organizations using SafePa for payment processing are at risk of data exfiltration, transaction disruption, and ransomware encryption of critical financial records. The attacks can lead to significant downtime and financial loss.
What to Do
- Audit all SafePa transaction logs for unauthorized or anomalous activity.
- Enforce multi‑factor authentication for all accounts with payment platform access.
- Isolate any endpoints that show signs of compromise and run full malware scans.
- Apply the latest security patches to the payment platform and associated infrastructure.
- Deploy endpoint detection and response (EDR) solutions to detect lateral movement and ransomware indicators.
- Block known malicious IP addresses and domains associated with Akira, ReadText34, and INC ransomware.
Mitigation Checklist
- Verify that all payment platform credentials are unique and strong.
- Enable logging and monitoring for all payment transactions.
- Implement network segmentation to limit lateral movement.
- Regularly review and update firewall and intrusion detection rules.
Related articles
LockBit RaaS Reputation Dynamics Revealed at Black Hat Europe 2025
At Black Hat Europe 2025, research on LockBit ransomware‑as‑a‑service highlighted how the group’s affiliate network and media coverage shape both victim and attacker reputations. The talk presented data on 194 affiliates, 110 negotiations, and 80 payments, underscoring that public perception can influence incident costs and decision‑making.
Read briefing
Egregor Ransomware: Recent TTPs and Defensive Actions
Egregor ransomware operators have intensified attacks, leveraging Windows PowerShell and remote desktop protocols to spread across networks. The latest campaigns target unpatched systems and use double‑extortion tactics. Defenders should harden RDP, enforce least‑privilege, and monitor for anomalous PowerShell activity.
Read briefing
RansomHub RaaS Operations: Affiliate Tactics and Extortion Methods
RansomHub, a ransomware‑as‑a‑service operation, has been actively recruiting affiliates and leveraging a sophisticated panel to coordinate attacks. The group’s extortion tactics target organizations across industries, demanding payment for data restoration and threat of public release. Defenders should monitor for RansomHub indicators, block affiliate panel traffic, and enforce strict patching and backup procedures.
Read briefing
Ransomware Landscape Shifts: Q2 2026 Report Highlights Growing Competition and AI‑Accelerated Ops
Check Point Research’s Q2 2026 ransomware report shows the ecosystem is still dominated by a handful of RaaS groups, but the tail is widening: 93 active actors now versus 71 in Q1, with the top 10 accounting for 57.6 % of victims (down from 71 %). Victim numbers stayed flat quarter‑on‑quarter, yet the US share dropped to 42 % as new groups like The Gentlemen and Krybit target fewer American targets. The Gentlemen’s internal leak revealed an AI‑powered ransomware‑management panel built in three days, marking the first hard evidence that generative‑AI is speeding up malicious tool development. P
Read briefing