SafePay ransomware has compromised at least 600 organizations across multiple critical-infrastructure sectors since August 2024, according to a joint advisory published October 20 by the Cybersecurity and Infrastructure Security Agency, FBI, U.S. Secret Service and law-enforcement partners in Germany and the United Kingdom. The victims span North America, South America, Europe and Australia, and the agencies describe SafePay as one of the most active ransomware groups of 2026.
The advisory says the operation combines stolen or guessed credentials, brute-force attacks, phishing and exploitation of public-facing systems. Investigators identified five vulnerabilities used against edge devices and internet-exposed infrastructure: CVE-2020-3259 and CVE-2023-20269 affecting Cisco Adaptive Security Appliance and Firepower Threat Defense software, along with CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. The agencies do not claim that every victim was compromised through a listed CVE.
The vulnerabilities are old and have patches or vendor mitigations available. The NVD rates CVE-2020-3259, an unauthenticated Cisco web-services memory-disclosure flaw, 7.5 High under CVSS 3.1. CVE-2023-20269 involves Cisco remote-access VPN authentication and authorization controls and is listed in CISA’s Known Exploited Vulnerabilities Catalog. NVD rates the Veeam Backup & Replication deserialization flaw, CVE-2024-40711, 9.8 Critical, while CVE-2024-40766 affects SonicWall SonicOS management access and is also rated 9.8 Critical by NVD. The advisory names CVE-2023-27532 but does not provide product-version or scoring details.
After gaining access, SafePay actors create or hijack accounts, elevate privileges and move laterally with legitimate administration tools including PowerShell, PsExec, Windows Remote Management, Remote Desktop Protocol, AnyDesk and TeamViewer. The group uses tools such as ShareFinder and SharpShares to locate network shares, and compresses or exfiltrates data with WinRAR, 7-Zip, RClone, WinSCP, FileZilla, OneDrive and Backblaze B2. This “living off the land” approach can make activity harder to distinguish from routine IT operations.
The impact extends beyond file encryption. According to the advisory, operators disable security software, halt the Volume Shadow Copy Service and reset network-attached storage containing backup data. SafePay encrypts files with a ChaCha20-and-RSA scheme, appends the .SafePay extension and threatens to publish stolen data when victims do not pay. The agencies say indicators observed between November 2024 and August 2026—including hashes, filenames, IP addresses and tool names—are included in the advisory for threat hunting.
Defenders should patch internet-facing firewalls, VPN appliances, backup servers and SonicWall, Cisco and Veeam deployments; remove unsupported versions; and review authentication and administrative logs for brute-force activity, newly created accounts and unusual remote-management sessions. CISA and its partners also recommend phishing-resistant multifactor authentication for VPN, webmail and privileged accounts, network segmentation, least-privilege access, endpoint monitoring and offline, immutable backups that are regularly tested. Organizations that detect a compromise should isolate affected systems, preserve evidence, investigate the published indicators and report the incident through CISA, the FBI or the relevant national authority.
