SafePay Ransomware: FBI, CISA and Partners Detail a 600-Victim Operation

Joint advisory AA26-293A, published October 20, 2026

SafePay Ransomware: FBI, CISA and Partners Detail a 600-Victim Operation

Threats

CISA FBI and IC3 MITRE ATT&CK NIST and the NIST Cybersecurity Framework (CSF 2.0)

The FBI, CISA, the U.S. Secret Service, and German and United Kingdom law enforcement partners published a joint #StopRansomware advisory on the SafePay ransomware group, which has hit at least 600 victims across critical infrastructure sectors since August 2024. SafePay actors get in through stolen or brute-forced credentials, phishing, and known flaws in Cisco ASA, Veeam Backup and Replication, and SonicWall SonicOS gear, then move with legitimate tools such as PsExec and WinRM, disable security software, steal data, and encrypt files with the .SafePay extension. The advisory stresses that backup infrastructure is a deliberate target: the group stops the Volume Shadow Copy Service and resets backup storage devices to factory settings.

Executives

A ransomware group with 600 known victims is winning through ordinary gaps: weak passwords, missing multifactor authentication, and unpatched edge devices. The business question is whether your backups are offline, immutable, and actually restore-tested, because this group hunts backups first.

CIO / CISO

Treat the advisory as a checklist. Confirm the five named CVEs are patched, MFA covers VPN and remote access, and administrative tools are restricted to the accounts that truly need them. Map your detections to the ATT&CK techniques in the advisory and review logs for PsExec, WinRM, and unexpected remote access tools.

Engineers

Patch Cisco ASA (CVE-2020-3259, CVE-2023-20269), Veeam (CVE-2023-27532, CVE-2024-40711), and SonicWall SonicOS (CVE-2024-40766). Audit Active Directory for new or unfamiliar admin accounts, watch for Volume Shadow Copy Service stops and NAS factory resets, and pull the advisory IOCs in STIX format into your tooling.

Everyone (non-IT)

This is the standard modern ransomware playbook, and it starts with passwords. Use unique passwords and turn on multifactor authentication everywhere it is offered, especially email, banking, and anything reachable from the internet.