Article
SafePay Ransomware Joint Advisory: Five Exploited Flaws and How to Close Them
CISA, the FBI and partners published advisory AA26-293A on SafePay ransomware. See the five exploited flaws, what to patch and one control for each.
Read more
Ransomware group profile
SafePay Ransomware Group
SafePay is a ransomware group that the FBI, CISA and partners say has been highly active since August 2024.
- Active
In short
SafePay is a ransomware group that the FBI, CISA and partners say has been highly active since August 2024. A joint advisory published on 20 October 2026 counts at least 600 separate victims, from multiple critical infrastructure sectors.
- StatusActiveas reported
- Entry Routes4ways inStolen or guessed passwords
- Techniques7mapped to MITRE ATT&CKExternal Remote Services · Remote Services
- Defences6first steps listed
Overview
SafePay is a ransomware group. Six agencies published joint advisory AA26-293A on 20 October 2026. They are the FBI, CISA, the US Secret Service, the Rhineland-Palatinate State Criminal Police Office (LKA Rheinland-Pfalz), the UK National Crime Agency and the UK North West Regional Organised Crime Unit. The advisory says SafePay has been highly active since August 2024 and has at least 600 separate victims.
The advisory says victims are in multiple critical infrastructure sectors, in North America, South America, Europe and Australia. It names no single sector. The group gets in with stolen or guessed passwords, phished account profiles, VPN access and five known exploited flaws in Cisco, Veeam and SonicWall products.
The five flaws are the part defenders can act on today. Our news post on the SafePay joint advisory maps each flaw to ATT&CK, with what to patch and one control. For the SonicWall flaw, see the page on CVE-2024-40766. The same two Cisco flaws also appear in our Akira ransomware profile.
A note on sources: the joint advisory is the main source. It does not name the products behind the CVEs; the product names come from the vendor advisories and the CISA catalog. The advisory gives no aliases and no affiliate model for SafePay, so this page makes no claim on either.
Timeline
-
Aug 2024
The advisory says SafePay has been highly active since August 2024.
-
Nov 2024 to Aug 2026
The period in which the advisory's indicators of compromise were observed.
-
20 Oct 2026
The FBI, CISA and partners publish joint advisory AA26-293A, which counts at least 600 separate victims.
How they get in
-
01
Stolen or guessed passwords
The advisory says actors typically get in by stealing or guessing passwords. It lists credential exposure and brute force (T1110). It also lists phished account profiles and VPN access from IP addresses of the Mullvad VPN provider.
-
02
Cisco ASA and FTD: CVE-2020-3259 and CVE-2023-20269
The advisory describes edge device exploitation after phished account profiles gave access. CVE-2020-3259 lets an unauthenticated attacker read device memory through the web services interface. CVE-2023-20269 allows brute force against remote access VPN accounts. Cisco lists fixed ASA releases such as 9.8.4.20 and 9.12.3.9 for the first flaw and says enabling MFA reduces the risk of the second.
-
03
Veeam Backup & Replication: CVE-2023-27532 and CVE-2024-40711
The advisory says both were exploited on internet-exposed systems with automated scripts (T1190). Veeam fixed the first in builds 12.0.0.1420 and 11.0.1.1261, and the second, an unauthenticated remote code execution flaw, in version 12.2 (build 12.2.0.334).
-
04
SonicWall SonicOS: CVE-2024-40766
The advisory says it was exploited on internet-exposed systems with automated scripts (T1190). The CVE record describes improper access control in SonicOS management access. It affects Gen 5 devices on SonicOS 5.9.2.14-12o and older, Gen 6 devices on 6.5.4.14-109n and older, and Gen 7 devices on 7.0.1-5035 and older. The fixed builds are in SonicWall advisory SNWLID-2024-0015.
How they extort
Double extortion in effect: data is copied out before encryption, and data of victims who do not pay is posted on the SafePay leak site. The ransom note says SafePay locked the system and points to a chat portal on a TOR address, where the victim logs in with an ID. The advisory says a representative also makes phone calls to pressure the victim, and that actors typically demand a subset of company revenue in cryptocurrency.
Techniques
- Technique Archive Collected Data Archive collected data is when an attacker packs stolen files into compressed or encrypted bundles before sending them out. T1560 · Collection
- Technique Command and Scripting Interpreter Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs. T1059 · Execution
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Indicator Removal Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind. T1070 · Stealth
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
How to defend
-
Patch known exploited flaws on internet-facing systems first
Start with the five flaws: Cisco ASA and FTD, Veeam Backup & Replication and SonicWall SonicOS. The advisory tells defenders to prioritize patching flaws in the CISA catalog, especially on internet-facing systems.
-
Require MFA on VPN, webmail and critical accounts
The advisory asks for multifactor authentication, especially for webmail, VPNs and accounts on critical systems. Cisco says MFA reduces the risk from CVE-2023-20269.
-
Use long passwords and lockouts
The advisory recommends passwords of 15 to 64 characters, no reuse and account lockout after failed attempts.
-
Keep encrypted, immutable, offline backups
Actors deleted network-attached backups, so keep copies that are physically separate, and test the restore.
-
Segment the network and watch for lateral movement
The advisory recommends network segmentation and EDR tools that detect lateral movement, plus a review of domain controllers, servers and Active Directory for accounts nobody recognises.
-
Watch for data leaving the network
Exfiltration tools in the advisory include RClone, WinSCP, FileZilla, Backblaze b2.exe and OneDrive. Alert on their use where you do not expect it.
Questions
What is SafePay ransomware?
SafePay is a ransomware group. The FBI, CISA and partners say it has been highly active since August 2024 and has at least 600 separate victims. It steals data, encrypts files with the .SafePay extension and threatens to publish the data.
Which flaws does SafePay exploit?
Advisory AA26-293A lists CVE-2020-3259 and CVE-2023-20269 in Cisco ASA and FTD, CVE-2023-27532 and CVE-2024-40711 in Veeam Backup & Replication, and CVE-2024-40766 in SonicWall SonicOS. CISA flags all five as used in ransomware.
How does SafePay get into a network?
Mainly through stolen or guessed passwords, brute force, phished account profiles, VPN access and the five flaws. The advisory lists these as initial access methods.
How do I know if my files were encrypted by SafePay?
The advisory says encrypted files are renamed with the .SafePay extension and a ransom note appears on the desktop or in the root directory. The note says SafePay locked the system.
Does SafePay steal data before encrypting?
Yes. The advisory describes data copied out with tools such as RClone and WinSCP before encryption. If the victim does not pay, the data is posted on the SafePay leak site.
In our research
Sources
- #StopRansomware: SafePay Ransomware (AA26-293A) CISA, FBI, US Secret Service, LKA Rheinland-Pfalz, UK NCA, NW ROCU
- Known Exploited Vulnerabilities catalog CISA
- Cisco ASA and FTD information disclosure (CVE-2020-3259) Cisco
- Cisco ASA and FTD remote access VPN unauthorized access (CVE-2023-20269) Cisco
- Veeam Backup & Replication credential exposure (CVE-2023-27532) Veeam
- Veeam security fixes of September 2024 (CVE-2024-40711) Veeam
- CVE-2024-40766 record CVE Program
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 26 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 55 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 37 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 50 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 105 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.