Pulp-style illustration of robots looting a vault of tape reels beneath a red padlock

SafePay: joint advisory on a ransomware crew with 600-plus victims

ALERT · Actively exploited. Last updated 23 October 2026. See the Alert Tracker

US, German and UK agencies have published a joint advisory on SafePay, a ransomware group with at least 600 victims. The playbook is old edge-device bugs, legitimate tools and a phone call to make sure you noticed.

The advisory

On 20 October 2026 the FBI, CISA and the US Secret Service, with Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency and the North West Regional Organised Crime Unit, released joint advisory AA26-293A on SafePay ransomware. CISA announced it the following day.

The headline numbers come straight from the advisory: “SafePay ransomware was among the most active ransomware groups in 2026.” And: “The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.” The advisory says the group has been active since August 2024, with victims in North America, South America, Europe and Australia, and its indicators run to investigations as recent as August 2026.

How they get in

Nothing here is exotic, which is the uncomfortable part. According to the advisory, SafePay actors use Mullvad VPN addresses together with phished account profiles to exploit edge-device flaws, specifically Cisco ASA bugs CVE-2020-3259 and CVE-2023-20269. They also exploit Veeam Backup & Replication (CVE-2023-27532 and CVE-2024-40711) and SonicWall (CVE-2024-40766), alongside brute-force password attacks.

The youngest of those CVEs is two years old. Chris Butera, CISA’s acting executive assistant director for cybersecurity, put it politely in the press release, saying that “Public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay Ransomware group”.

Once inside

The tooling list reads like an IT department’s toolkit, because mostly it is one:

  • Movement and discovery: PsExec, WinRM and RDP, with ShareFinder.ps1, SharpShares.exe and NetExec for enumeration.
  • Credentials: Mimikatz and a DCSync tool, plus UAC bypass and token impersonation.
  • Collection and theft: 7-Zip, WinRAR, FileZilla, WinSCP and RClone, sometimes OneDrive, and in at least one case the Backblaze B2 command-line tool, b2.exe.
  • Remote access: AnyDesk, TeamViewer and ScreenConnect.

Before encryption, the advisory says, the actors “halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts”. The NAS reset is a nasty touch: the backups aren’t encrypted, they simply stop existing.

Encryption combines ChaCha20 with RSA and appends .SafePay to files. Victims are pointed to a Tor chat portal, and “a representative makes phone calls on behalf of the ransomware group.” Data from non-payers goes to a leak site. The ransomware may then delete itself.

A word on the indicators

The advisory lists IP addresses observed between November 2024 and August 2026. Several sit in Cloudflare, GitHub and Google address space, which is what you would expect from actors using legitimate cloud services. The authors themselves “recommend organizations investigate or verify IP addresses prior to taking action, such as blocking.” Blocking GitHub’s address range wholesale would be a memorable way to start a Monday.

What to do

  1. Patch the edge. The advisory urges prioritising Known Exploited Vulnerabilities on internet-facing systems and points to Binding Operational Directive 26-04 for prioritisation and forensic triage. Check the five CVEs above first.
  2. Protect backups from the network they protect. Keep offline, encrypted, immutable copies. Our advice: patch Veeam and keep its server off the general domain if you can.
  3. Phishing-resistant MFA for VPN and remote access. The advisory also recommends passwords of 15 to 64 characters.
  4. Restrict remote-access and admin tools. Inventory AnyDesk, TeamViewer and ScreenConnect, disable command-line and scripting tools where they aren’t needed, and use just-in-time admin access.
  5. Segment the network so one VPN account doesn’t reach the NAS.
  6. Hunt. Our Hunt Lab piece has untested draft Sigma rules for shadow copy tampering and the exfiltration tools named here.

In the UK, report incidents to Report Fraud or on 0300 123 2040, or to your local police force.

More on actively exploited flaws and ransomware campaigns is in Threats & Vulnerabilities.

Sources