SafePay ransomware has hit 600 victims, says joint FBI and CISA advisory

SafePay ransomware has hit 600 victims, says joint FBI and CISA advisory

20 October 2026: The FBI, CISA and the US Secret Service, with Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit, say the SafePay ransomware group has hit at least 600 victims across critical infrastructure sectors in North America, South America, Europe and Australia since August 2024. Their joint advisory, AA26-293A, calls it one of the most active groups of 2026 and lists the flaws it uses to get in.

How SafePay gets in

The group's routes are ordinary ones, which is the point of the advisory: stolen, guessed or brute-forced passwords, phished accounts, VPN logins from addresses belonging to the Mullvad VPN service, and automated exploitation of internet-facing systems. The agencies list five CVEs:

• CVE-2020-3259 and CVE-2023-20269, which the advisory describes as edge device flaws (an information exposure and an authentication bypass)
• CVE-2023-27532, missing authentication for a critical function
• CVE-2024-40711, deserialisation of untrusted data
• CVE-2024-40766, improper access control

The advisory names weaknesses rather than products. CISA's own catalogue of exploited flaws fills in the rest: the first two are in Cisco's Adaptive Security Appliance and Firepower Threat Defense, the third and fourth in Veeam Backup & Replication, and the fifth in SonicWall SonicOS. All five were added to that catalogue between 2023 and 2024 and are marked there as known to be used in ransomware campaigns, so fixes for every one have been available for at least a year.

What the group does once inside

SafePay operators use Mimikatz, PsExec, WinRM and token impersonation to move around, NetExec, ShareFinder.ps1 and SharpShares.exe to find data, and RDP, AnyDesk, TeamViewer or ScreenConnect for remote access. Data leaves through 7-Zip and WinRAR archives sent with RClone, WinSCP, FileZilla, Backblaze's b2 tool or OneDrive. Before encrypting, they disable security software, change user passwords, stop the Volume Shadow Copy service and, in a step backup teams should note, reset network-attached storage holding backups to factory settings or delete network-attached backups outright.

Encryption combines ChaCha20 with RSA, renames files with a .SafePay extension and leaves a note pointing to a Tor chat portal. The group posts stolen data to a leak site, telephones victims to press them, and typically demands "a subset of company revenue" in cryptocurrency.

Where defenders get most from the advisory

Two of the five flaws sit in a backup product, and the group's habit of wiping network-attached backup storage means a backup that the domain can reach is not a recovery plan. The agencies ask for offline, encrypted and immutable copies with tested restores, multifactor authentication on VPNs and webmail, long passwords with lockouts, and patching of exploited flaws on anything facing the internet first. Indicators of compromise covering November 2024 to August 2026 are published with the advisory in STIX format. Our server backup software category lists 20 products, and the questions to ask any of them after this advisory are whether its storage can be made immutable and whether it can be reached with domain credentials.

Related on TrustList:

• Veeam fixes critical remote code flaw in Backup & Replication 12
• Software takeovers on 30 September and 1 October 2026: Opus 2 buys Bundledocs, Xopero buys Vigil Guard

Sources

• CISA: #StopRansomware: SafePay Ransomware (AA26-293A), 20 October 2026
• CISA: Known Exploited Vulnerabilities Catalog (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766; read 2026-10-21), 21 October 2026