SafePay Ransomware 600 Organizations Explained: Inside the FBI-CISA Advisory on Backup-Destroying Attacks

Illustrative image: a ransomware lock screen. SafePay's own variant appends the .SafePay extension and drops a readme_safepay.txt note. (Image: Wikimedia Commons / Motormille2, public domain)

TL;DR — SafePay ransomware 600 organizations explained: on 20 October 2026, six agencies from the US, Germany and the UK issued joint #StopRansomware advisory AA26-293A warning that the SafePay crew has hit at least 600 organizations since August 2024. It breaks in through VPNs and known firewall/backup flaws, destroys backups first, then encrypts — with a revenue-based ransom.

📌 Key Highlights

• Advisory AA26-293A, released 20 October 2026 by the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit — six agencies, one playbook.
• At least 600 victims across critical-infrastructure sectors in North America, South America, Europe and Australia since August 2024 — among 2026's most active ransomware operations.
• Entry routes: brute-forced VPN credentials routed through Mullvad VPN exit nodes, phished account profiles, and automated exploitation of five CVEs in Cisco ASA/FTD, Veeam Backup & Replication and SonicWall SonicOS.
• Signature cruelty: halts Volume Shadow Copy, deletes shadow copies, factory-resets network-attached storage holding backups, and kills backup-agent processes — no easy recovery.
• Defense: patch the five CVEs, enforce MFA on all remote access, and keep backups offline, immutable and restore-tested.

What happened?

On 20 October 2026, CISA published #StopRansomware advisory AA26-293A — "SafePay Ransomware" jointly with the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the UK's North West Regional Organised Crime Unit. Pooling investigations through August 2026, it concludes SafePay has compromised "at least 600" organizations since August 2024 — and runs as a non-RaaS operation, handling every attack stage itself with tight, consistent execution across all 600 intrusions.

The warning was picked up widely on 21–23 October by CyberNews, SecurityAffairs, GBHackers and cybersecuritynews. Researchers have linked the group to attacks on businesses including Microlise, Ingram Micro and Deutsche Telekom's T-Systems subsidiary.

SafePay ransomware 600 organizations explained: the attack chain

The advisory describes a methodical double-extortion playbook:

• Initial access: compromised or brute-forced credentials aimed at exposed VPN endpoints (connections observed from Mullvad VPN exit nodes), phished account profiles replayed against exposed VPNs, and automated scripts exploiting five known CVEs on internet-facing devices.
• Inside: SafePay lives off the land — PsExec, Windows Remote Management (WinRM) and RDP for lateral movement, ShareFinder.ps1 / SharpShares.exe to map file shares, Mimikatz and dcsync.exe to harvest credentials.
• Steal first: data is compressed with 7-Zip or WinRAR and exfiltrated via Rclone to actor-controlled accounts, with OneDrive used in some intrusions.
• Destroy the lifeboat: before encrypting, SafePay halts the Volume Shadow Copy Service, deletes shadow copies, resets backup NAS devices to factory settings and kills backup-agent processes — MITRE T1490, inhibit system recovery.
• Encrypt: a ChaCha20 + RSA hybrid cipher (full or partial, by file type and size); files get the .SafePay extension and a readme_safepay.txt note points victims to a Tor chat portal. A representative also phones victims to apply pressure; unpaid data goes to the leak site. There is no way to decrypt without the operator-held key.
• The demand: typically a subset of the victim's revenue in cryptocurrency. The agencies are explicit: paying does not guarantee recovery and funds further crime.

The five CVEs SafePay exploits

CVE	Affected product	Why it matters
CVE-2020-3259	Cisco ASA / Firepower Threat Defense	Information exposure — exploited with phished account profiles
CVE-2023-20269	Cisco ASA / Firepower Threat Defense	Improper access control on the VPN edge
CVE-2023-27532	Veeam Backup & Replication	Flaw in the backup software itself — on the very box SafePay destroys
CVE-2024-40711	Veeam Backup & Replication	Critical (CVSS 9.8) — unauthenticated remote code execution via deserialization
CVE-2024-40766	SonicWall SonicOS	Management-access flaw; can expose resources and crash firewalls

All five are listed in CISA's Known Exploited Vulnerabilities catalog — patching them is the advisory's single highest-priority ask.

Illustrative image: officials at the International Counter Ransomware Initiative Summit in Washington DC (2023). The SafePay advisory AA26-293A was issued jointly by six agencies across the US, Germany and the UK. (Image: Wikimedia Commons / Ooligan, public domain)

Why it matters for World Tech readers

SafePay confirms a nasty 2026 pattern: backup infrastructure is now the primary target, not collateral damage. The same month, the ConnectWise cloud-backup compromise by China's Storm-0940 showed state-aligned crews attacking backup software too — while the n0n ransomware's $1.2 billion CyberLogitec supply-chain attack proved industrial ransom demands are scaling into the billions.

For Indian organizations, the exposure is identical to everyone else's: exposed Cisco, Veeam and SonicWall edge devices plus remote-work VPNs are exactly what SafePay automates against. And trust infrastructure is creaking on another front too — CERT-In's advisory on compromised eMudhra certificate keys makes October 2026 the month to fix both the front door and the foundations.

Should you care?

✅ Patch now if you run exposed Cisco ASA/FTD, Veeam Backup & Replication or SonicWall SonicOS — SafePay's automated scripts target exactly these.

✅ Check your backups today: offline, encrypted, immutable, restore-tested — SafePay kills reachable backups first.

⏳ Home users with no exposed services: background reading — keep devices updated and turn on MFA where it is offered.

What the advisory says you must do now

• Remediate the five known exploited vulnerabilities immediately — patching KEV entries is the top ask.
• Enforce multi-factor authentication for VPNs, webmail and all accounts touching critical systems; move toward Zero Trust remote access.
• Restrict or disable admin tools (PsExec, RDP, command shells) for accounts that don't need them; review every admin-privileged account.
• Segment networks, monitor for lateral movement, and keep backups offline, encrypted and immutable — with regularly tested restores.
• Report incidents to law enforcement; do not pay the ransom.

FAQs

How many organizations has SafePay hit?
At least 600, according to the joint advisory released 20 October 2026 — organizations in critical-infrastructure sectors across North America, South America, Europe and Australia, compromised since August 2024.

How does SafePay gain access to victim networks?
Through compromised or brute-forced credentials, phishing, and automated exploitation of five known CVEs on internet-facing VPNs, firewalls and backup servers.

Does SafePay destroy backups before encrypting?
Yes. It halts the Volume Shadow Copy Service, deletes shadow copies, resets backup NAS devices to factory settings and terminates backup-agent processes — MITRE ATT&CK T1490 (inhibit system recovery).

What should organizations do to protect against SafePay?
Patch the five CVEs, enforce MFA on remote access, restrict administrative privileges, segment networks, keep backups offline and immutable, and report incidents to law enforcement instead of paying.

Takeaway

SafePay is this month's reminder that ransomware crews now destroy the lifeboat before sinking the ship. Patch the edge, isolate and test the backups — and the whole playbook falls apart.

Follow World Tech on TechByCountry for hourly updates.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• CISA — #StopRansomware: SafePay Ransomware (AA26-293A), 20 Oct 2026: cisa.gov/news-events/cybersecurity-advisories/aa26-293a
• SecurityAffairs — FBI and CISA warn of SafePay ransomware attacks on 600 organizations, 23 Oct 2026: securityaffairs.com
• CyberNews — SafePay ransomware hits 600 organizations worldwide, 22 Oct 2026: cybernews.com
• cybersecuritynews.com — SafePay ransomware has affected 600+ organizations, 22 Oct 2026: cybersecuritynews.com
• GBHackers — CISA warns SafePay ransomware has hit 600+ organizations, 22 Oct 2026: gbhackers.com
• SafeBreach — SafePay ransomware: AA26-293A coverage, 23 Oct 2026: safebreach.com
• DecryptionDigest — SafePay ransomware hits 600+ orgs, destroys backups: decryptiondigest.com
• Orbitaley — Six agencies warn SafePay ransomware has hit at least 600 organisations, 21 Oct 2026: orbitaley.com