SafePay Ransomware Hits 600 Victims as FBI, CISA and Allies Issue Joint Warning
Do Son 
| At a glance | |
| Malware family | SafePay ransomware (encrypted files end in .SafePay) |
| Threat actor | SafePay ransomware group; no individuals named |
| Targets | At least 600 victims across critical infrastructure and business, per the authoring agencies |
| Delivery vector | Stolen or guessed passwords, phished VPN accounts, and edge device flaws |
| Key capabilities | Living-off-the-land movement, security tool tampering, data theft, ChaCha20 and RSA encryption, backup wiping |
| Source | Joint advisory AA26-293A from the FBI, CISA, USSS, Germany’s LKA Rheinland-Pfalz, the UK NCA, and the UK NWROCU |
TL;DR
On October 20, 2026, six US, German, and UK agencies published a joint #StopRansomware advisory on SafePay ransomware. The group has hit at least 600 victims since August 2024. It breaks in through weak passwords, phished VPN accounts, and unpatched firewalls and backup servers.
Who SafePay is
SafePay has struck businesses and critical infrastructure across North America, South America, Europe, and Australia. The agencies say it “was among the most active ransomware groups in 2026.” Their findings come from FBI, Secret Service, and German police investigations as recent as August 2026.
The advisory does not name any person behind the group. Attribution here covers the SafePay operation as a whole, based on law enforcement casework.
Delivery
SafePay actors get in through several doors. First, they use exposed or brute-forced credentials. Second, they log in with phished VPN accounts, often through Mullvad VPN addresses. From there, they target two older flaws in edge devices, CVE-2020-3259 and CVE-2023-20269.
In addition, the group runs automated scripts against internet-facing systems. The advisory lists three more flaws: CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. These affect backup servers and firewalls that many firms still leave unpatched.
Which products are at risk
The advisory lists only CVE numbers. However, public vendor records show which products they affect. CVE-2020-3259 and CVE-2023-20269 hit Cisco ASA and Firepower Threat Defense VPN features. Meanwhile, CVE-2023-27532 and CVE-2024-40711 affect Veeam Backup & Replication. CVE-2024-40766 is an access control flaw in SonicWall SonicOS. All five are years old, and fixes have long been available.
Infection chain
Persistence and stealth
Once inside, the actors gain admin rights on existing accounts or create new ones. They rely on built-in Windows tools, a method known as living off the land. For example, they run commands remotely with PsExec and WinRM.
Next, they map file shares with scripts such as ShareFinder.ps1 and SharpShares. Before moving further, they often switch off security software. In some cases, they also changed user passwords to lock out staff.
Privilege escalation and lateral movement
To gain higher rights, SafePay uses a known User Account Control bypass and token impersonation. Then it spreads with RDP, remote management tools, and stolen admin credentials. The toolkit also includes Mimikatz, NetExec, and a DCSync tool for pulling Active Directory credentials.
Command-and-control and data exfiltration
SafePay ransomware actors steal data before they encrypt anything. It packs files with 7-Zip or WinRAR. Then it moves them out with RClone, WinSCP, FileZilla, OneDrive, or a Backblaze B2 command-line tool. In other cases, it installs AnyDesk, TeamViewer, or ScreenConnect to keep access and drop files.
After theft, the group blocks recovery. It stops the Volume Shadow Copy Service and resets backup storage devices to factory settings. Finally, it encrypts files with a mix of the ChaCha20 cipher and RSA keys. The agencies warn that this data “cannot be recovered without the decryption key.”
Extortion tactics
A ransom note points victims to a Tor chat portal. According to the advisory, SafePay “typically demand[s] a subset of company revenue in cryptocurrency.” To raise pressure, a representative also phones the victim. If the victim refuses to pay, the stolen data appears on SafePay’s leak site.
Defense and detection guidance
The full list of tools, hashes, and MITRE ATT&CK mappings appears in CISA’s #StopRansomware advisory on SafePay ransomware. Key steps include:
- Patch firewalls, VPNs, and backup servers first, starting with the five listed CVEs.
- Require MFA for VPNs, webmail, and admin accounts.
- Use long passwords and lock accounts after repeated failed logins.
- Keep offline, encrypted, and immutable backups, and test restores often.
- Segment networks to slow lateral movement.
- Restrict PsExec, WinRM, and scripting tools to the staff who need them.
- Watch for unexpected remote access tools, such as AnyDesk or ScreenConnect.
- Alert on large uploads to cloud storage from servers.
- Review Active Directory for new or unfamiliar admin accounts.
If you spot an intrusion
The advisory also sets out first steps for teams that catch SafePay before encryption. First, isolate the affected hosts. Next, hunt across logs to find every compromised account and device. Then build an eviction plan before you lock the attackers out, so they cannot slip back in.
The agencies also urge victims not to pay. As they note, payment “does not guarantee victim files will be recovered.” Instead, report incidents to the FBI’s IC3, CISA, or the UK’s national reporting service.
Overall, SafePay ransomware relies on familiar entry points and legitimate tools. As a result, basic patching, MFA, and offline backups remain the strongest defense.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
