CISA and FBI: SafePay ransomware has hit at least 600 critical infrastructure organisations since August 2024

The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, together with the US Secret Service and police agencies in Germany and the UK, have published a joint #StopRansomware advisory on SafePay, saying the group has affected at least 600 organisations in critical-infrastructure sectors since August 2024. The advisory (AA26-293A, released 20 October 2026) lists how SafePay gets in, what it does once inside, and what defenders should do, including a short list of older vulnerabilities in edge devices that the group exploits. For anyone running VPNs, firewalls or remote-access tools, it is a checklist worth reading against your own estate.

Key points

• The advisory AA26-293A, dated 20 October 2026, is from the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency and North West Regional Organised Crime Unit.
• It says SafePay has been active since August 2024 and has affected at least 600 victims across multiple critical-infrastructure sectors in North America, South America, Europe and Australia.
• Initial access comes from exposed or guessed credentials, brute force, phishing and VPN access, notably from IP addresses of the Mullvad VPN provider, plus exploitation of edge-device flaws.
• Encryption uses ChaCha20 with RSA, files get the .SafePay extension, and the group halts Volume Shadow Copy Service and resets network storage that holds backups.
• The agencies advise against paying ransoms and recommend multifactor authentication, prompt patching of known exploited vulnerabilities, and offline, immutable backups.

What happened

CISA's listing for the advisory describes it as based on investigations through August 2026. It says SafePay "is one of the most active ransomware groups", per the wording BleepingComputer quotes from the advisory, and that it has affected businesses and critical infrastructure on four continents, "including at least 600 organizations" in multiple critical-infrastructure sectors since August 2024. The advisory gives no breakdown of that figure by sector or country. BleepingComputer points out that the real number of breached organisations is probably higher, because the group's leak site lists only those who do not pay.

How SafePay gets in

According to the advisory, initial access comes through several routes: stolen or exposed credentials, brute-force password attacks, phishing, and use of VPN access, particularly from IP addresses of the Mullvad VPN provider. The advisory names five vulnerabilities in internet-facing systems that the group has exploited:

• CVE-2020-3259 and CVE-2023-20269, described as used together with phished account profiles;
• CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, exploited through automated scripts against exposed systems.

None of these is new, which is the point: the advisory tells defenders to prioritise known exploited vulnerabilities on VPNs, firewalls and other edge devices. (We have not looked up the affected products for each identifier here; check CISA's catalog of known exploited vulnerabilities for the products behind each CVE.)

What it does once inside

The advisory describes a mostly "living off the land" intrusion. SafePay gains administrator rights on existing accounts or creates new ones, escalates with a UAC bypass and token impersonation, and moves sideways with PsExec, WinRM, RDP and remote-management software. It disables security software, and in some cases changes user passwords to lock out valid users. For data theft, it compresses files with 7-Zip, WinRAR or RClone and sends them out with WinSCP, RClone, FileZilla, Backblaze's b2.exe or OneDrive. It installs AnyDesk or TeamViewer to deliver the ransomware and other tools. The advisory cautions that legitimate tools should not be labelled malicious without evidence that the threat actor used them.

Encryption, backups and extortion

The ransomware uses hybrid encryption that combines ChaCha20 with RSA; the encryption can be full or partial depending on file type and size, and files are renamed with the .SafePay extension. Before or while encrypting, it halts Volume Shadow Copy Service and resets network-attached storage that holds backups to factory settings; in some cases network backups were deleted. The binary may delete itself afterwards.

Ransom notes point victims to a Tor chat portal using a victim ID. The advisory says demands are typically a portion of company revenue, paid in cryptocurrency, that a representative phones victims to pressure them, and that data of non-paying victims is posted on a leak site.

Background

SafePay emerged in August 2024 as a private group that, unlike many ransomware operations, does not work with affiliates, according to BleepingComputer. That description is not universal: a security-vendor summary we found describes affiliate-style roles instead, so the structure of the group is a point where sources disagree, and the joint advisory as summarised to us does not settle it.

Earlier reporting gives a sense of its growth. A July 2025 law-firm briefing, Robinson+Cole's Data Privacy + Security Insider, reported that NCC Group had found SafePay hit more victims than any other actor in May 2025 and that trackers then linked it to 248 victims. It also described social-engineering calls impersonating a company's IT department over Microsoft Teams, followed by a request for remote access and a PowerShell script. That is consistent with the advisory's mention of phishing and remote-management tools. BleepingComputer says SafePay has since filled some of the gap left by BlackCat (ALPHV) and LockBit.

type: bar
title: SafePay victims, as counted by each source
unit: organisations
source: Robinson+Cole (July 2025, leak-site trackers); CISA AA26-293A (Oct 2026)
CISA/FBI advisory, Oct 2026 (critical infrastructure, at least) | 600
Public trackers, July 2025 | 248

The two figures are not like for like: the advisory counts affected critical-infrastructure organisations from law-enforcement investigations, while the 2025 number comes from leak-site trackers and covers a different period. We show them only to indicate scale.

What it means

For security teams. The advisory is mostly a list of well-known weaknesses. The initial-access routes (credentials, brute force, edge-device bugs) are controllable. Multifactor authentication on VPNs, webmail and critical systems, lockouts after repeated failures, and patching the listed CVEs address the entry points. The agencies recommend passwords of 15 to 64 characters, unique credentials, and avoiding frequent forced resets.

For backup owners. Because the group targets shadow copies and resets NAS devices, backups that sit on the same network are at risk. The advisory recommends encrypted, immutable, offline backups and regular restore tests.

For incident responders. The advisory includes indicators of compromise: nine IP addresses, a table of suspicious files (including locker.dll and dcsync.exe), four SHA-1 and six SHA-256 hashes, and four hostnames beginning with "WIN-", with STIX files to download. It warns to verify IP addresses and tool use before blocking, since cloud addresses are reassigned and some listed tools are legitimate.

For everyone else. The Mullvad detail should be read carefully. The advisory says the group uses Mullvad addresses; it does not say Mullvad users are suspect, and a blanket block of a consumer VPN service would be a policy decision, not something the advisory demands.

What we don't know yet

• Where the 600 comes from. The advisory gives no breakdown by sector or country, nor how it counted.
• Who is behind it. We saw no attribution in the material we reviewed.
• How the group is organised. Sources disagree about whether it works with affiliates.
• Which products are affected. We have not verified the product behind each listed CVE.

What to watch next

Expect security vendors to publish detection rules based on the advisory's indicators, and watch for updates to the advisory itself, which CISA revises as agencies learn more. Check your own estate for the five listed vulnerabilities and for unexpected remote-management tools such as AnyDesk, TeamViewer or ScreenConnect.

Sources

• CISA, #StopRansomware: SafePay Ransomware (AA26-293A) (primary source)
• BleepingComputer, CISA: SafePay ransomware hit over 600 critical infrastructure orgs
• Robinson+Cole, What to know about SafePay ransomware group