SafePay Ransomware Joint Advisory: Five Exploited Flaws and How to Close Them

Six agencies published joint advisory AA26-293A on 20 October 2026. They are the FBI, CISA, the US Secret Service, the Rhineland-Palatinate State Criminal Police Office (LKA Rheinland-Pfalz), the UK National Crime Agency and the UK North West Regional Organised Crime Unit. The advisory covers SafePay, a ransomware group the advisory calls highly active since August 2024, with at least 600 separate victims from multiple critical infrastructure sectors.

For defenders the useful part is the entry list. The advisory names five known exploited flaws in edge and backup products. This post puts them in one table, with the fix and one control for each. The group itself is described in our SafePay ransomware profile.

What the Advisory Says About SafePay

The advisory says actors typically get in by stealing or guessing passwords. It also lists brute force (T1110), phished account profiles, VPN access from IP addresses of the Mullvad provider and the five flaws below.

Once inside, the actors copy data out before they encrypt anything. The tools named include RClone, WinSCP, FileZilla and Backblaze b2.exe. Files are then encrypted and renamed with the .SafePay extension. Victims are pointed to a chat portal on a TOR address, and the data of those who do not pay is posted on the group’s leak site.

The Five Flaws and What to Do About Each

All five are in the CISA Known Exploited Vulnerabilities catalog, flagged for known ransomware use. The advisory does not name the products, so the table takes them from the vendor advisories. The ATT&CK column is our mapping, not the advisory’s.

The advisory says the last three flaws were exploited on internet-exposed systems with automated scripts, which is exploiting a public-facing application. For the two Cisco flaws it describes edge device exploitation after phished account profiles were used to reach the network.

Cisco ASA and FTD

CVE-2020-3259 lets an unauthenticated attacker read device memory with a crafted request, but only on certain AnyConnect and WebVPN setups. CVE-2023-20269 does not bypass authentication. It lets an attacker brute-force valid usernames and passwords, so a valid second factor still stops the session. Cisco’s own advisory says enabling MFA reduces the risk. The same two flaws appear in our Akira ransomware profile.

Veeam Backup and Replication

CVE-2023-27532 lets an unauthenticated user on the network request encrypted credentials from the configuration database. CVE-2024-40711, rated 9.8 by Veeam, allows unauthenticated remote code execution on version 12.1.2.172 and earlier version 12 builds. Backup servers matter here because the advisory says actors sometimes deleted all network-attached backups. Older Veeam flaws are covered in our post on two critical Veeam vulnerabilities. Veeam’s updates of 27 October 2026 fix five newer flaws in Backup & Replication, its Linux agent and Veeam ONE, described in our post on the Veeam Backup and Replication patch.

SonicWall SonicOS

The CVE record calls CVE-2024-40766 an improper access control flaw in SonicOS management access. It affects Gen 5 devices on SonicOS 5.9.2.14-12o and older, Gen 6 devices on 6.5.4.14-109n and older, and Gen 7 devices on 7.0.1-5035 and older. Our page on CVE-2024-40766 has the detail.

Beyond Patching: Passwords, VPN and Backups

Patching closes five doors. The first access method in the advisory is still the password. Its recommendations are short:

• Require MFA, especially for webmail, VPNs and accounts on critical systems.
• Use passwords of 15 to 64 characters, no reuse, and lock accounts after failed attempts.
• Keep encrypted, immutable, offline backups and test the restore.
• Segment the network, and use EDR to catch lateral movement.
• Check domain controllers, servers and Active Directory for accounts nobody recognises.

The advisory also lists T1685, Disable or Modify Tools, so alert when a security tool stops or is changed. For hunt steps against another ransomware crew’s security killers, see how to hunt for the Lindnor backdoor and EDR killers.

What to Do This Week

First, find out which of the five products you run and which version. Second, compare the version with the table. Third, check that every VPN account asks for a second factor. Fourth, confirm that one backup copy cannot be reached from the domain. If a flaw was open on an internet-facing system, treat it as a possible intrusion and review that system’s accounts and logs.

We ranked this advisory third among the eight stories in our review of the week in cybersecurity, next to the PHP, Plex and VeloCloud flaws.