SafePay Ransomware Hit 600 Victims, and the Advisory's Newest CVE Is From 2024

The FBI, CISA, the U.S. Secret Service and police in Germany and the United Kingdom said on Oct. 20 that the SafePay ransomware group has hit at least 600 organizations since August 2024. Their joint advisory, AA26-293A, calls SafePay "among the most active ransomware groups in 2026".

The attacker's first need is a working login, not a zero-day (a flaw the vendor has had no time to fix). Of the five CVEs the advisory names, the newest was assigned in 2024, so patched edge devices close part of the route but not the credential one.

How SafePay gets in

The advisory lists three routes: credential exposure and brute-force password attacks (MITRE ATT&CK technique T1110), abuse of VPN access including connections from Mullvad VPN provider addresses, and automated scripts that exploit internet-exposed systems (T1190). Phished account profiles are also used to reach victim networks.

Investigations ran through August 2026, with indicators observed from November 2024. The agencies base the advisory on FBI and German law enforcement cases.

The five CVEs and what the advisory says about them

CVE	Class named in advisory	Use
CVE-2020-3259	CWE-200, information exposure	Edge device exploitation
CVE-2023-20269	CWE-288, authentication bypass	Edge device exploitation
CVE-2023-27532	CWE-306, missing authentication	Automated exploitation
CVE-2024-40711	CWE-502, deserialization	Automated exploitation
CVE-2024-40766	CWE-284, improper access control	Automated exploitation

The Record, which reported the advisory the same day, says the list continues with "others". The advisory itself does not rank the CVEs by how many intrusions each caused, so the table shows a list, not a measure of exposure.

What happens after entry

According to the advisory, SafePay actors gain administrator rights on existing or new accounts and move laterally with PsExec, WinRM, RDP and remote management software, using ShareFinder.ps1 and SharpShares.exe to find file shares. Data leaves through 7-Zip or WinRAR archives and tools such as RClone, FileZilla and WinSCP. AnyDesk or TeamViewer is used to deliver the malware.

Before encryption the group halts the Volume Shadow Copy Service and resets network-attached backup devices to factory settings. Encryption combines ChaCha20 and RSA and appends .SafePay to files, and the advisory says data "cannot be recovered without the decryption key".

Ransom demands are typically a share of company revenue, paid in cryptocurrency. Extortion includes phone calls and posting stolen data on a leak site.

Indicators and the scoring caveat

The advisory publishes 9 IP addresses, 30 malicious or suspicious files, 4 SHA-1 hashes, 6 SHA-256 hashes and 4 hostnames. It cautions that cloud-hosted addresses can be reassigned, so verify before blocking, and that tools such as 7-Zip, PsExec and RClone should not be treated as malicious without evidence of actor use.

The Record cites claimed SafePay attacks on Ingram Micro, Microlise and the government technology contractor Conduent, and reports that experts see parts of SafePay's code resembling LockBit. Those are claims and observations from that outlet, not findings in the advisory.

What the agencies tell defenders to do

The advisory points to BOD 26-04 for patch prioritization, which fits the pattern in CISA's split Plex2Shell deadlines. It asks for multi-factor authentication on webmail, VPNs and critical-system accounts, passwords of 15 to 64 characters, lockouts after repeated failures, and encrypted, immutable offline backups with tested restores. The password guidance includes forcing a change no more than once a year. A patch alone also does not remove a foothold, as the AhsayCBS 10.3.4 case showed.

The agencies advise against paying, and ask victims to report to the FBI's IC3 or to CISA. Tables 6 to 16 of the advisory map the activity to ATT&CK v20 for defenders who want to test detections.