On 20 October, CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the North West Regional Organised Crime Unit published a joint #StopRansomware advisory (AA26-293A) on SafePay. The agencies say the group has affected at least 600 separate victims across multiple critical infrastructure sectors in North America, South America, Europe and Australia since August 2024, and describe it as among the most active ransomware groups of 2026. The advisory draws on investigations running as recently as August 2026.
What the advisory says
Initial access. SafePay obtains entry through exposed or guessed credentials, brute-force attacks and VPN access. The agencies report the actors use Mullvad VPN addresses and phished account profiles to reach victim networks. Five known vulnerabilities are named, all of which carry CISA Known Exploited Vulnerabilities entries according to NVD:
- CVE-2020-3259 and CVE-2023-20269 (Cisco ASA and Firepower Threat Defense)
- CVE-2023-27532 and CVE-2024-40711 (Veeam Backup & Replication)
- CVE-2024-40766 (SonicWall SonicOS)
The Veeam and SonicWall flaws are described as exploited through automated scripts against internet-exposed systems.
Movement and tooling. Once inside, the actors create or take over administrative accounts, then use PsExec, WinRM, RDP and remote management software to spread. ShareFinder.ps1 and SharpShares.exe are used to locate file shares. Security software is commonly disabled before encryption. Data leaves through RClone, WinSCP and FileZilla, and in some cases OneDrive. AnyDesk and TeamViewer are installed to deliver the ransomware.
Impact. The group stops the Volume Shadow Copy Service and, per the advisory, resets network-attached storage holding backups to factory settings. Files are encrypted with a ChaCha20 and RSA hybrid scheme and given a .SafePay extension. Victims are directed to a Tor chat portal, and a representative phones victims to add pressure. Unpaid victims are posted to a leak site. Ransom demands are typically a share of company revenue.
Context
SafePay is not new to this site. Our August deep-dive covered its rise from a late-2024 leak site to a high-volume operation. What changes here is the weight of the source: a multinational law-enforcement and cyber agency advisory with a downloadable IOC set (STIX XML and JSON) rather than vendor telemetry. The advisory also confirms the group’s dependence on old, well-documented flaws rather than zero-days. Several of the named CVEs date from 2020 and 2023.
What it means for affected sectors
Healthcare, utilities, manufacturing and local government all rely on VPN gateways and backup servers that match the profile described. Targeting of backup infrastructure matters most: if backups sit on the same network as production and share admin credentials, a successful intrusion removes the recovery path before the ransom note appears. The advisory does not break victims down by sector, so sector-specific risk should be judged from your own exposure.
Recommended actions
- Confirm all five CVEs are patched on Cisco ASA/FTD, Veeam and SonicWall assets, and check exposed management interfaces.
- Enforce MFA on all VPN and remote access, and review logins from Mullvad or other anonymising VPN ranges.
- Hunt for unexpected AnyDesk or TeamViewer installs, new administrative accounts, and RClone or WinSCP activity.
- Keep immutable or offline backups with separate credentials, and protect NAS devices from remote factory reset.
- Ingest the advisory’s STIX indicators into detection tooling, and report incidents to the FBI IC3, CISA or, in the UK, Report Fraud.