SafePay's Five Named CVEs Are All Two Years Old or More, and All Sit on Cisco, Veeam and SonicWall Gear
Security / news
SafePay's Five Named CVEs Are All Two Years Old or More, and All Sit on Cisco, Veeam and SonicWall Gear
The joint advisory counts at least 600 SafePay victims since August 2024; BleepingComputer's write-up names no CVEs, but the advisory lists five.
SafePay ransomware has hit at least 600 organizations since August 2024, and it gets in through exposed credentials, VPN access, phished accounts or unpatched edge devices, according to joint advisory AA26-293A released October 20.
The advisory comes from CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the North West Regional Organised Crime Unit. Its indicators cover activity observed from November 2024 through August 2026, and it calls the group "among the most active ransomware groups in 2026."
The five CVEs the advisory lists
BleepingComputer's report by Sergiu Gatlan, published October 21, names no specific CVEs and points only to CISA's Known Exploited Vulnerabilities catalog. The advisory page does name five, and the NVD records show each was published at least two years before it.
| CVE | Product | CVSS 3.1 (NVD) | Added to KEV |
|---|---|---|---|
| CVE-2020-3259 | Cisco ASA and FTD | 7.5 | 2024-02-15 |
| CVE-2023-20269 | Cisco ASA and FTD | 9.1 | 2023-09-13 |
| CVE-2023-27532 | Veeam Backup & Replication | 7.5 | 2023-08-22 |
| CVE-2024-40711 | Veeam Backup & Replication | 9.8 | 2024-10-17 |
| CVE-2024-40766 | SonicWall SonicOS | 9.8 | 2024-09-09 |
The advisory tags the two Cisco bugs as edge-device entries and the other three as targets of automated scripts. NVD publication dates run from May 6, 2020 for CVE-2020-3259 to September 7, 2024 for CVE-2024-40711.
The score overstates one of them. NVD rates CVE-2023-20269 at 9.1, but Cisco's own score is 5.0, and the Cisco advisory text quoted in the NVD record says the flaw "does not allow an attacker to bypass authentication." An unauthenticated attacker can brute-force valid credentials, which fits the advisory's listing of credential attacks as an access route. The Terminal found no source that ties SafePay's brute-forcing to this specific bug.
What happens after access
The advisory describes a hands-on intrusion. Operators add admin rights to existing or new accounts, bypass User Account Control, and move with PsExec, WinRM, RDP and SMB admin shares. They locate shares with ShareFinder.ps1 and SharpShares.exe.
Data leaves through tools including RClone, WinSCP, FileZilla and OneDrive, and the advisory notes Backblaze's b2.exe was also used. AnyDesk and TeamViewer deliver malware. Before encrypting with a ChaCha20 and RSA hybrid scheme, which writes a .SafePay extension, the operators stop Volume Shadow Copy Service and reset NAS backup devices to factory settings.
Ransom demands are typically "a subset of company revenue," paid in cryptocurrency, and the advisory gives no amounts. Victims get a note pointing to a Tor chat portal, then phone calls, and unpaid victims are posted to a leak site.
BleepingComputer adds that SafePay appeared in August 2024 as a private group that does not work with affiliates, and that it has filled the gap left by BlackCat and LockBit since the start of 2025. It also notes the leak site lists only victims who did not pay, so the true count is higher than 600.
Indicators and what to do
The advisory lists 9 IP addresses, more than 30 named malicious files including locker.dll and dcsync.exe, 4 SHA-1 hashes, 6 SHA-256 hashes and 4 hostnames. Full indicators are in linked STIX XML and JSON files. It warns that legitimate tools in its table "should not be attributed as malicious without analytical evidence," and that some listed IP addresses belong to legitimate services, so they need verifying before blocking.
The mitigations start with patching internet-facing systems, prioritizing KEV-listed flaws on firewalls and other edge devices, then multifactor authentication on webmail, VPNs and critical accounts. The advisory also recommends encrypted, immutable, offline backups with tested restores, which matters because the group targets NAS backups directly.
CISA's October listings have carried three-day deadlines, and edge devices from Cisco keep appearing in ransomware cases, as in September's Sandworm and Qilin report. Reports go to the FBI's IC3, a local FBI or Secret Service field office, or CISA at 1-844-Say-CISA.
Sources
More in Security
- 01PHP Has an Unpatched RCE, CVE-2026-115560, That Needs Three Conditions Including a Runtime Serialize-Handler SwitchThe PHP team gave the flaw no severity score and no affected versions, and says the fix waits for the next regular release.
- 02OpenAI Moves Frontier Training Offline and Reports VM Escapes in Kata, gVisor and Docker, a Week After Federal Containment GuidanceOpenAI's October 23 post could not be fetched by The Terminal, so this reading rests on three accounts of it and sets them against the October 16 NIST, NSA and CISA practices.
- 03HTTP2Shell Is a Brotli Bug, Not a Node.js One, and Its Fixes Span PyPI, Envoy, Istio and BunCVE-2026-111497 sits in Google's Brotli decoder, so the patch list runs well past Node.js, and whether it gives code execution or only a crash is still argued.
- 04Railway Says Attacker Decrypted Environment Variables for Up to 1.85% of WorkspacesIts October 22 preliminary report points to a hunt for AI provider keys, names no root cause, and has not ruled out access to customer source code.