Latest / Tech Talks With Kinsoft / Energy Action Breach – SafePay Ransomware Targets an Energy Giant

Transcript

Energy Action Breach – SafePay Ransomware Targets an Energy Giant · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. I want you
• 0:02
  to think for a second about... The kinds of businesses
• 0:06
  that operate almost entirely in the background.
• 0:09
  Right. The ones without the flashy consumer commercials.
• 0:11
  Exactly. I mean, they don't sell retail products,
• 0:14
  but they work quietly behind the scenes to save
• 0:16
  other businesses money or, you know, optimize
• 0:19
  their operations. And those exact companies,
• 0:22
  the ones meant to be these quiet custodians of
• 0:24
  corporate efficiency, they are increasingly finding
• 0:27
  themselves staring down the barrel of massive
• 0:30
  digital extortion attempts. Yeah. Which brings
• 0:32
  us to today's analysis. Right now, one of those
• 0:35
  exact background custodians, an Australian energy
• 0:38
  management firm called Energy Action, is caught
• 0:41
  in a developing cyber incident. Right. With a
• 0:44
  highly sophisticated ransomware group known as
• 0:46
  SafePay. And it highlights one of the most critical
• 0:48
  vulnerabilities in our modern digital landscape.
• 0:51
  I mean, the more interconnected and vital a B2B
• 0:54
  service becomes to its clients, the larger the
• 0:57
  bullseye on its back. Definitely. And the information
• 1:00
  we are analyzing today comes from a recent exclusive
• 1:02
  report by Daniel Croft at Cyber Daily. And it
• 1:06
  provides a pretty stark look at how these threats
• 1:09
  are evolving. So mapping out the immediate situation
• 1:11
  based on Croft's reporting from early May 2026,
• 1:15
  energy action actually appeared on the dark web
• 1:18
  leak site belonging to the SafePay ransomware
• 1:21
  gang. Right. And to understand the stakes here,
• 1:24
  we really have to look at what Energy Action
• 1:25
  actually does. I mean, they aren't a power plant.
• 1:28
  No, they're a consulting firm. Right. Their mandate
• 1:30
  is to highlight energy usage inefficiencies for
• 1:33
  other businesses, you know, helping companies
• 1:35
  avoid what they term bill shock. And guiding
• 1:38
  them toward net zero emissions, which is actually
• 1:41
  a benchmark the company's already achieved internally.
• 1:44
  Oh, wow. So they actually practice what they
• 1:45
  preach. Exactly. They function essentially as
• 1:48
  an optimization engine for corporate Australia's
• 1:50
  energy consumption. I mean, they manage a very
• 1:53
  significant share of the country's commercial
• 1:55
  business energy spend. But before we examine
• 2:00
  the broader implications, we really need to underscore
• 2:02
  that these claims are currently alleged. Yes,
• 2:05
  that is a very important distinction to make.
• 2:07
  Because the timing and the confirmation are both
• 2:09
  critical factors here. At the time Cyber Daily
• 2:13
  published their report, SafePay hadn't actually
• 2:15
  disclosed specific details of the incident. No,
• 2:18
  and they hadn't confirmed the actual volume of
• 2:21
  data they claimed to possess either. Right. Instead,
• 2:23
  they just initiated a countdown. They threatened
• 2:26
  to leak the alleged... stolen data in just over
• 2:29
  two days from the article's publication. And
• 2:31
  at that exact moment, Energy Action had not publicly
• 2:34
  disclosed any incident and Cyber Daily was just
• 2:37
  waiting on a formal response. Which creates this
• 2:40
  really volatile holding pattern. It does. Threat
• 2:43
  actors frequently use that ticking clock on a
• 2:46
  public leak site to force a victim's hand. Just
• 2:48
  dialing up the pressure. Exactly. They operate
• 2:51
  on the assumption that public pressure and, you
• 2:54
  know, the fear of the unknown will expedite a
• 2:56
  ransom payment. Wait, I'm trying to score the
• 2:59
  target with the threat here, though. If energy
• 3:01
  action's primary function is just managing power
• 3:03
  usage to prevent corporate bill shock, why is
• 3:07
  a highly organized ransomware group wasting their
• 3:09
  time on them? I mean, utility blueprints and
• 3:12
  efficiency metrics don't exactly sound like the
• 3:15
  kind of high -dollar corporate secrets that trigger
• 3:17
  massive payouts. Well, on the surface, an energy
• 3:20
  bill doesn't really sound like a goldmine. But
• 3:23
  the value to the attacker isn't in a single company's
• 3:26
  energy usage. Where is it, then? The value lies
• 3:29
  entirely in the aggregation. You have to think
• 3:32
  of a consulting firm not as a single target,
• 3:34
  but as the central nervous system for hundreds
• 3:37
  of other businesses. Ah, so by compromising the
• 3:40
  consultancy, they are accessing the shared circulatory
• 3:42
  system of all their corporate clients. Precisely.
• 3:45
  If a threat actor breaches a single retail store,
• 3:48
  they acquire that one store's data. But if they
• 3:52
  breach a management firm that services hundreds
• 3:53
  of diverse businesses. They get everything. Right.
• 3:56
  they potentially gain access to a staggering
• 3:59
  trove of aggregated corporate intelligence. We
• 4:02
  are talking about highly sensitive procurement
• 4:04
  records, detailed energy account data, and vast
• 4:09
  cross -industry directories of corporate contacts.
• 4:12
  Which drastically changes the leverage. Absolutely.
• 4:15
  Because the attackers aren't just holding Energy
• 4:17
  Action's internal memos hostage, they are threatening
• 4:19
  to expose the sensitive operational data of every
• 4:22
  single company that trusted Energy Action with
• 4:25
  their business. And that threat is existential
• 4:27
  for a B2B service provider. The reputational
• 4:30
  damage for a consultancy that fails to protect
• 4:33
  client data is, well, it's often catastrophic.
• 4:36
  Yeah. And the attackers obviously know that.
• 4:39
  Oh, they are acutely aware that these firms are
• 4:41
  under immense pressure from their own clients
• 4:43
  to resolve breaches quietly and quickly. So they
• 4:46
  just calculate their ransom demands based on
• 4:48
  that cascading pressure. Exactly. They're basically
• 4:50
  monetizing the target's foundation of trust.
• 4:53
  Man. To really grasp the severity of this alleged
• 4:56
  threat, though, we have to look closely at the
• 4:58
  group making the claims. Right. SafePay is a
• 5:01
  relatively new name in the broader timeline of
• 5:03
  cybercrime, but they have escalated their operations
• 5:06
  at a terrifying speed. Yeah, they have. According
• 5:09
  to the reporting, they first emerged in October
• 5:11
  2024. And in roughly a year and a half, they
• 5:14
  have claimed more than 450 victims. Which is
• 5:17
  an incredible volume. Claiming 450 victims in
• 5:20
  an 18 month window requires an immense, highly
• 5:23
  sophisticated operational infrastructure. Yeah,
• 5:25
  that is not the work of a few rogue hackers in
• 5:28
  a basement. No, it is the footprint of a major
• 5:30
  digital enterprise. And their geographic reach
• 5:33
  confirms that enterprise scale. I mean, they've
• 5:36
  targeted organizations in Australia, the UK,
• 5:38
  the US, Italy, New Zealand, Canada, Belgium,
• 5:42
  Brazil, Germany. Barbados, Argentina. It is a
• 5:46
  completely global dragnet. But the detail that
• 5:48
  truly separates SafePay from the rest of the
• 5:50
  pack is their business model. Yes, this is the
• 5:53
  really fascinating part. They explicitly state
• 5:55
  on their dark web leak site, and this is a direct
• 5:57
  quote, SafePay ransomware has never provided
• 6:00
  and does not provide the Reyes. And that public
• 6:03
  declaration is incredibly significant. In the
• 6:05
  current cybercrime ecosystem, almost everyone
• 6:08
  operates on the Reyes model. Right. And for anyone
• 6:11
  listening who isn't entrenched in threat intelligence,
• 6:13
  Reyes stands for ransomware as a service. Right.
• 6:17
  It operates remarkably similarly to franchising
• 6:20
  a fast food chain. You have top tier developers
• 6:23
  who sit at the top of the pyramid. They write
• 6:25
  the complex malicious code, the actual encryption
• 6:27
  software, and they maintain the extortion leak
• 6:31
  sites. But they don't actually break into companies
• 6:33
  themselves. No, they rent their software out
• 6:36
  to affiliates. And these affiliates are essentially
• 6:38
  independent contractors who do the dirty work
• 6:41
  of fishing employees, bypassing firewalls, and
• 6:45
  deploying the locker. And when a ransom is paid,
• 6:48
  the affiliate and the developer just split the
• 6:50
  profits. Exactly. It is an incredibly successful
• 6:53
  model because it allows for rapid scaling. The
• 6:56
  developers avoid the operational risk of network
• 6:59
  intrusion. And the affiliates don't need the
• 7:01
  advanced coding skills required to build unbreakable
• 7:04
  encryption algorithms. They just buy the toolkit
• 7:06
  and start hunting. But let me push back a bit
• 7:08
  here. OK, sure. If you or I are sitting at a
• 7:10
  compromised corporate terminal staring at a red
• 7:13
  screen demanding cryptocurrency, does it actually
• 7:16
  matter to us how the criminals organize their
• 7:18
  HR department? I mean, the files are locked,
• 7:21
  whether the attacker is an independent affiliate
• 7:23
  or a salaried employee of the syndicate. Well.
• 7:27
  From the perspective of the immediate panic,
• 7:29
  you were absolutely right. The operational disruption
• 7:31
  feels identical. Right. However, from the perspective
• 7:35
  of incident response, defense strategy, and negotiation,
• 7:39
  the distinction between a decentralized Reyes
• 7:43
  affiliate and a centralized in -house cartel
• 7:46
  changes everything. Walk us through the mechanics
• 7:49
  of that. Why does an in -house operation change
• 7:51
  the defensive playbook? Because Reyes networks,
• 7:54
  by their very nature, are chaotic. Affiliates
• 7:57
  have wildly varying levels of skill. You might
• 8:00
  have a highly sophisticated initial access broker
• 8:02
  who breaches a network flawlessly, but they hand
• 8:05
  the access over to an inexperienced affiliate
• 8:07
  who makes incredibly noisy mistakes. Like what
• 8:09
  kind of mistakes? Well, they might use off -the
• 8:11
  -shelf tools that trigger security alerts, or
• 8:14
  they might fail to cover their tracks, you know,
• 8:17
  leaving forensic footprints that allow incident
• 8:20
  responders to figure out exactly how they got
• 8:22
  in. And then they just close the door. Exactly.
• 8:25
  So an affiliate model is inherently messier.
• 8:27
  You have multiple independent actors touching
• 8:30
  the network, which just increases the surface
• 8:33
  area for errors. Right. And in addition to the
• 8:35
  technical errors, the Ray S model introduces
• 8:38
  immense friction during the negotiation phase.
• 8:41
  Oh, really? How so? Sometimes an affiliate will
• 8:44
  successfully extort a company, receive the multi
• 8:47
  -million dollar payout, and then simply vanish
• 8:50
  without providing the decryption key. Oh, wow.
• 8:53
  Or... The affiliate wants to decrypt your files,
• 8:55
  but the developer's Tor infrastructure gets taken
• 8:57
  offline by law enforcement, making the decryption
• 9:00
  tool completely unavailable. So the victim is
• 9:03
  left entirely helpless even after complying.
• 9:06
  Yes. That actually makes the in -house claim
• 9:08
  by SafePay much more intimidating, but paradoxically
• 9:12
  maybe more reliable. Yes. Reliable is the perfect
• 9:14
  word for it. Because if they handle everything
• 9:16
  from the initial breach to the malware development
• 9:18
  to the negotiation, they control the entire lifecycle
• 9:22
  of the attack. That is the crucial takeaway.
• 9:24
  Centralized groups are highly consistent. Because
• 9:28
  the same internal teams are conducting the breaches,
• 9:30
  their tactics, techniques, and procedures, their
• 9:33
  TTPs remain uniform across different attacks.
• 9:36
  Which means threat intelligence teams can build
• 9:39
  much more accurate behavioral profiles. Exactly.
• 9:42
  We know the specific tools they prefer, the types
• 9:45
  of vulnerabilities they exploit, and how they
• 9:47
  move laterally through a network. And I guess
• 9:49
  it also means they have absolute control over
• 9:51
  their brand reputation on the dark web. Absolutely.
• 9:54
  Extortion relies entirely on trust. You know,
• 9:57
  the perverse trust that if a victim pays, the
• 10:00
  criminal will honor the deal. And in -house syndicate
• 10:03
  like SafePay relies on future victims believing
• 10:05
  that paying actually works. Yeah. If they get
• 10:08
  a reputation for taking the money and refusing
• 10:10
  to decrypt files, their leverage in future negotiations
• 10:13
  evaporates instantly. Makes total sense. So when
• 10:16
  an incident response firm negotiates with a centralized
• 10:19
  group, they operate with a higher degree of confidence
• 10:22
  that they are dealing with the actual decision
• 10:25
  makers who have the power. power to return the
• 10:27
  data. OK, understanding that SafePay operates
• 10:30
  as this cohesive, disciplined unit makes their
• 10:33
  targeting strategy even more perplexing when
• 10:36
  we look at their past victims. It does seem a
• 10:38
  bit contradictory at first. Yeah, because Croft's
• 10:41
  article details a few recent breaches that highlight
• 10:43
  their operational history. In February 2026,
• 10:46
  they hit Genealogy Essay. Right, a South Australia
• 10:49
  -based genealogy nonprofit. dedicated to historical
• 10:53
  family records and the timeline of that specific
• 10:55
  incident provides a really great look into how
• 10:58
  these attacks unfold over time. It definitely
• 11:00
  does. According to the organization's public
• 11:02
  statements, they detected the incident, immediately
• 11:05
  engaged cybersecurity experts, successfully contained
• 11:08
  the breach on their network, and proactively
• 11:10
  communicated with their members. From a crisis
• 11:12
  management perspective, they followed the playbook.
• 11:15
  They did. And yet, months later, on April 16th,
• 11:18
  SafePay listed them on their leak site and ultimately
• 11:21
  published the data. And this illustrates the
• 11:23
  concept of dwell time. and the separation of
• 11:26
  exfiltration from encryption. Which means what
• 11:29
  exactly? In modern extortion, the deployment
• 11:32
  of the ransomware, you know, the moment the screens
• 11:34
  turn red and the files lock, is actually the
• 11:37
  final stage of the attack. Oh, so by the time
• 11:39
  you know you are under attack, the worst part
• 11:41
  has already happened. Right. Long before the
• 11:44
  ransomware is detonated, the attackers have been
• 11:47
  quietly navigating the network, finding the sensitive
• 11:49
  file shares, and slowly siphoning that data out
• 11:53
  to their own servers. So Genealogy SA contained
• 11:56
  the active threat and stopped the operational
• 11:58
  disruption, but the data had already left the
• 12:01
  building. Exactly. And the variety of the data
• 12:03
  SafePay dumped from that nonprofit is staggering.
• 12:07
  Yeah, it included business, financial, and insurance
• 12:09
  documents. It included historic genealogical
• 12:12
  data and personal details found in correspondence.
• 12:15
  They even uploaded internal organizational templates
• 12:17
  and generic labels. Which is just so weird. Generic
• 12:20
  labels. Well, the inclusion of internal templates
• 12:22
  suggests they aren't executing surgical, highly
• 12:25
  targeted data thefts. So they aren't just looking
• 12:28
  for the high -value stuff. No, they are establishing
• 12:30
  persistence in the network. finding the primary
• 12:32
  file servers, and executing a mass exfiltration.
• 12:36
  They copy the entire directory tree, mundane
• 12:39
  administrative templates and all, because it
• 12:42
  is faster and requires less manual sorting while
• 12:45
  they are inside the victim's environment. Wow.
• 12:47
  They just take everything that isn't nailed down.
• 12:50
  Pretty much. Now contrast Genealogy SA with another
• 12:53
  safe pay victim from July 2025, Ingram Micro.
• 12:57
  We are talking about an absolute behemoth of
• 13:00
  a global IT distributor. Right. The fallout there
• 13:03
  resulted in the compromise of personally identifiable
• 13:07
  information for more than 42 ,000 individuals.
• 13:10
  You are looking at two organizations that share
• 13:12
  absolutely zero structural, financial, or operational
• 13:15
  similarities. And this is where I struggle to
• 13:17
  see the strategy. You have Ingram Micro, a multi
• 13:20
  -billion dollar tech giant. You have Genealogy
• 13:23
  SA, a regional nonprofit tracking family trees.
• 13:25
  And now we have Ener - action a corporate energy
• 13:28
  consultancy how does a highly disciplined in
• 13:31
  -house cyber syndicate justify deploying their
• 13:34
  centralized resources against such a random assortment
• 13:37
  of targets it feels completely scattershot it
• 13:40
  appears completely random if we assume threat
• 13:42
  actors operate like traditional bank robbers
• 13:44
  who carefully select a high value target exactly
• 13:47
  and then spend weeks figuring out how to break
• 13:49
  that specific vault but in the digital realm
• 13:52
  The logic is inverted. This is the reality of
• 13:55
  opportunistic exploitation. Meaning they aren't
• 13:58
  picking the target. They are picking the vulnerability.
• 14:01
  Precisely. They do not decide to attack a genealogy
• 14:04
  nonprofit. Instead, their automated infrastructure
• 14:07
  scans the entire Internet. Millions of IP addresses
• 14:11
  looking for a single specific flaw. OK. They
• 14:15
  might write a script that searches the globe
• 14:16
  for an unpatched version of a popular enterprise
• 14:19
  firewall or a known vulnerability in a remote
• 14:22
  desktop protocol. So it is the digital equivalent
• 14:25
  of walking down a street that is 10 ,000 miles
• 14:27
  long and just jiggling every single doorknob
• 14:30
  at lightning speed to see which ones happen to
• 14:32
  be unlocked. That analogy is perfectly accurate.
• 14:34
  Automated scanners can probe the entire IPv4
• 14:37
  address space in a matter of hours. That's terrifying.
• 14:40
  And when the script finds an unlocked door...
• 14:42
  you know, an unpatched server, it automatically
• 14:45
  exploits the flaw and establishes a quiet foothold.
• 14:48
  It is only after the initial access is secured
• 14:50
  that the human operators log in, look around,
• 14:53
  and figure out who they just breached. They break
• 14:56
  in first and ask questions later. Like, we just
• 14:59
  breached a global IT distributor. Excellent.
• 15:02
  Map the network. Extract the PII and demand a
• 15:04
  massive ransom. Or we just breached a regional
• 15:08
  nonprofit. Well, the door was open. We are already
• 15:10
  inside. Exfiltrate the server and demand a smaller
• 15:13
  sum. Because the automated nature of the initial
• 15:16
  access means the cost of breaching the nonprofit
• 15:18
  is effectively zero. They simply monetize whatever
• 15:22
  falls into the net. And this fundamentally destroys
• 15:25
  the old concept of security by obscurity. Many
• 15:28
  organizations assume they are too small or their
• 15:30
  industry is too niche to attract the attention
• 15:32
  of an elite cyber cartel. But SafePay's victim
• 15:35
  list proves that your industry does not dictate
• 15:38
  your threat level. Your perimeter defense dictates
• 15:40
  your threat level. If a device is connected to
• 15:42
  the internet and it is vulnerable, the scanners
• 15:45
  will find it, regardless of what the company
• 15:47
  actually does. Wow. Synthesizing all of this
• 15:49
  brings the situation with energy action into
• 15:51
  very sharp focus. We are watching a developing
• 15:54
  standoff involving an alleged breach of an Australian
• 15:57
  energy consultancy. And the adversary, SafePay,
• 16:01
  operates with the speed and global reach of a
• 16:04
  massive enterprise, claiming hundreds of victims
• 16:06
  in a matter of months. Right. They achieved that
• 16:09
  scale not through the chaotic, decentralized
• 16:11
  affiliate model that dominates the industry,
• 16:14
  but through a tightly controlled in -house operation.
• 16:17
  And because they rely on opportunistic exploitation,
• 16:20
  their victim profile ranges from global tech
• 16:23
  giants to local nonprofits. And when a group
• 16:26
  with that level of discipline manages to compromise
• 16:28
  a B2B consultancy like Energy Action, the leverage
• 16:31
  shifts dramatically. It really does. They aren't
• 16:34
  just holding one company's data. They are holding
• 16:37
  the aggregated, sensitive operational data of
• 16:40
  every corporate client that consultancy serves.
• 16:43
  Which is a stark reminder to approach early claims
• 16:46
  on dark web leak sites with a critical eye, right?
• 16:50
  Because threat actors routinely exaggerate the
• 16:52
  scope of a breach during the negotiation window.
• 16:55
  They do. But the underlying mechanism of the
• 16:57
  threat is very real. Yeah. And the evolution
• 17:00
  of safe pay. raises a profound question that
• 17:02
  security professionals and business leaders really
• 17:05
  need to consider. Over the last several years,
• 17:08
  the ransomware economy has been defined by ransomware
• 17:11
  as a service. The decentralized affiliate model
• 17:13
  won out because it scaled so quickly. Right.
• 17:16
  But recently, we have seen law enforcement agencies
• 17:18
  get much better at dismantling grass networks
• 17:20
  precisely because those networks are noisy. Affiliates
• 17:24
  make mistakes, servers get seized, and the infrastructure
• 17:27
  crumbles. So the messiness of the franchise model
• 17:30
  is actually becoming a liability for the cartels.
• 17:33
  Exactly. SafePay is succeeding wildly. By doing
• 17:37
  the exact opposite, they're running a closed
• 17:39
  -door, highly centralized syndicate. And if the
• 17:42
  broader cyber underworld observes Safetay's success
• 17:45
  and realizes that the Reyes model is too vulnerable
• 17:48
  to law enforcement disruption... We may be on
• 17:50
  the precipice of a massive shift back to the
• 17:53
  era of the disciplined cyber cartel. Wow. And
• 17:56
  if threat actors tighten their operational security
• 17:58
  and centralize their tactics, the corporate defense
• 18:00
  playbook, which has spent years calibrating to
• 18:03
  fight disorganized affiliates, is going to face
• 18:06
  a very steep, very dangerous learning curve.
• 18:09
  Yeah, as the adversary is tightening their ranks
• 18:11
  and becoming more disciplined, our defensive
• 18:13
  strategies have to evolve to match that precision.
• 18:16
  Absolutely. And it brings us right back to the
• 18:18
  premise we started with. The quiet companies
• 18:21
  operating in the background, you know, managing
• 18:23
  our energy profiles or maintaining our IT infrastructure,
• 18:26
  are often the ones holding the master keys to
• 18:28
  the broader economy. They are the prime targets
• 18:31
  in a landscape driven by opportunistic scanning
• 18:33
  and aggregated data. Well, we want to thank you
• 18:36
  for joining us for this analysis today. And if
• 18:38
  understanding the mechanics of these threats
• 18:40
  has sparked any questions about your own network
• 18:42
  architecture or the security posture of the third
• 18:45
  -party vendors you rely on, don't wait for a
• 18:48
  dark web countdown clock to start assessing your
• 18:51
  risk. Absolutely. We highly encourage you to
• 18:53
  visit www .kinsoft .com .au to discuss your own
• 18:57
  security and IT needs and ensure your business
• 18:59
  has the defenses in place to avoid becoming the
• 19:02
  next headline. Stay vigilant out there.