CISA, FBI Warn SafePay Ransomware Has Hit 600+ Organizations

CISA and the FBI, joined by the U.S. Secret Service and law enforcement partners in Germany and the United Kingdom, published a joint cybersecurity advisory on October 20, 2026, warning that the SafePay ransomware group has compromised more than 600 organizations since emerging in August 2024. The advisory, tracked as AA26-293A, lays out how the group breaks into networks, how it sabotages backups before encrypting files, and what defenders should do about it.

The advisory lands as SafePay has become one of the more prolific ransomware operations tracked this year, hitting targets across multiple critical infrastructure sectors in North America, South America, Europe and Australia. Unlike many of the ransomware brands that dominate headlines, SafePay reportedly runs as a closed, in-house operation rather than renting its malware out to a network of affiliates — a structural difference that shapes how it operates and how defenders should think about the threat.

What the SafePay ransomware advisory says

The joint advisory is part of the ongoing #StopRansomware initiative, a series of advisories CISA and the FBI publish jointly to document active ransomware operations, their technical behavior, and recommended defenses. AA26-293A was co-authored with the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency, and that agency's North West Regional Organised Crime Unit, reflecting SafePay's footprint across multiple countries.

According to the advisory, SafePay actors have compromised at least 600 organizations since activity began in August 2024, with observed indicators spanning from November 2024 through August 2026. Victims span North America, South America, Europe and Australia, and the agencies say multiple critical infrastructure sectors have been affected, though the advisory does not break victims down by specific sector.

Who is behind SafePay

SafePay first appeared in the ransomware landscape in August 2024 and has since built a reputation among incident responders as an unusually prolific operator. What sets it apart structurally, according to security researchers who have tracked the group, is that it does not run as a ransomware-as-a-service affiliate program the way operations like LockBit or ALPHV have. Instead, the same core group reportedly handles initial access, deployment and extortion itself, rather than licensing its encryptor to outside affiliates who do the actual breaching.

That closed structure is worth flagging for defenders because it changes the usual threat model. Affiliate-driven ransomware operations tend to produce messier, more varied intrusion patterns because many different affiliates use the same toolkit with their own techniques. A single, closed group like SafePay is more likely to show consistent tradecraft across victims — which is partly why the CVE list and tooling in the advisory look so specific.

How SafePay gets in: VPNs, stolen credentials and known CVEs

Per the advisory, SafePay's initial access relies on a mix of credential-based and vulnerability-based methods rather than custom zero-days. The agencies describe:

• Exposed or stolen credentials and brute-force password attacks
• VPN access, including use of IP addresses associated with the Mullvad VPN provider
• Phished account access
• Automated exploitation of known, already-patched vulnerabilities on internet-exposed edge devices

That last point is the one most organizations can act on immediately: the advisory lists specific CVEs SafePay actors have exploited to get a foothold, none of which are new or unpatched zero-days. They are all vulnerabilities with patches that have been publicly available for one to six years.

All five CVEs sit in CISA's Known Exploited Vulnerabilities catalog, which the advisory points defenders to directly as a patching priority list. The pattern echoes other recent edge-device advisories — Pandromeda covered a similar dynamic with the Ivanti Connect Secure VPN flaw CISA warned about earlier this year, where attackers moved quickly once a working exploit became public.

Inside a SafePay intrusion: access to encryption

Once inside, the advisory describes a fairly methodical progression. SafePay actors reportedly create new admin accounts or escalate privileges on existing ones, and have been observed bypassing User Account Control through a COM-based elevated process and using token impersonation to move into higher-privilege contexts. From there they lean on built-in and legitimate tools rather than custom malware for much of the intrusion: PowerShell and the Windows command shell for execution, PsExec, WinRM, RDP and remote monitoring and management (RMM) software for lateral movement, and scripts like ShareFinder and SharpShares to map out network shares.

For defense evasion, the agencies note that SafePay actors disable security software, change system passwords to lock out legitimate users, use packing and VM-based protection to obscure their tools, and delete files tied to the intrusion as they go. Mimikatz is referenced among the credential-access tooling observed in victim environments.

For staging and exfiltration, the advisory lists 7-Zip, WinRAR and RClone for compressing and staging stolen data, WinSCP, FileZilla and RClone again for moving it out over alternative protocols, and OneDrive for exfiltration through a trusted web service — a technique that is harder for some network defenses to flag because the traffic blends in with legitimate cloud storage use. Remote access tools like AnyDesk and TeamViewer are reportedly used to actually deliver the ransomware payload.

Sabotaging recovery: shadow copies and NAS backups

Before encrypting, SafePay actors reportedly go after an organization's ability to recover on its own. The advisory describes two specific sabotage steps: halting the Volume Shadow Copy Service to prevent Windows' built-in file recovery, and resetting network-attached storage (NAS) devices that hold backups — in some cases factory-resetting them entirely, wiping the backups they contained. Only after recovery options are degraded does encryption happen, using what the advisory describes as a hybrid ChaCha20 and RSA scheme, with files fully or partially encrypted depending on type and size. Encrypted files are appended with a .SafePay extension.

This sequencing is a reminder that "we have backups" isn't sufficient on its own — the advisory's mitigation section specifically calls for offline, immutable backup copies kept in physically separate, segmented locations precisely because network-reachable backups are a target, not a safety net, once an intrusion is underway. Pandromeda has covered similar recovery failures in other incidents, including how a compromised railway operator's network was breached and what responders did afterward.

Double extortion: encryption, leak threats and phone calls

SafePay runs a standard double-extortion model, but with an added pressure tactic the advisory specifically flags: in some cases, a representative of the group has made direct phone calls to victims. Alongside encrypting files, the group threatens to publish stolen data, and demands are made in cryptocurrency, reportedly scaled to a percentage of the victim organization's revenue, in exchange for decryption software.

Victims are typically left a ransom note on the desktop or root directory of affected systems, directing them to a Tor-based chat portal tied to a unique victim ID. If a victim doesn't pay, the advisory says stolen data is posted to SafePay's leak site, which is linked directly from the ransom note. CISA and the FBI reiterate standard guidance here: paying a ransom does not guarantee files will actually be recovered, and law enforcement discourages payment while urging victims to report incidents regardless of whether they pay.

Scale of the threat: 600+ victims, four continents

The 600-plus victim count cited in the advisory covers activity CISA, the FBI and their partners have tied to SafePay since August 2024. The affected organizations span North America, South America, Europe and Australia, and the agencies say the victims include organizations across multiple critical infrastructure sectors, though the advisory itself doesn't enumerate those sectors individually. That geographic spread, and the international list of co-authoring agencies, underscores why this is a joint advisory rather than a single-country alert — SafePay's victims and the law enforcement response to it both cross borders.

Why SafePay doesn't recruit affiliates

Most of the ransomware brands that make headlines — LockBit, ALPHV/BlackCat, and others — operate as ransomware-as-a-service platforms, where a core developer team licenses its encryptor and leak-site infrastructure to independent affiliates who do the actual breaching in exchange for a cut of ransom payments. Security researchers who have tracked SafePay describe it differently: as a closed, non-affiliate operation where the same group handles access, deployment and extortion itself, and reportedly even states on its own leak site that it does not recruit affiliates.

That matters for defenders because it means the group's tradecraft is likely to be more consistent across victims than an affiliate-driven operation's would be — which is reflected in how specific and repeatable the tooling and techniques listed in the advisory are. It may also explain why the group has kept a comparatively low public profile relative to its victim count: fewer people involved in an operation generally means fewer opportunities for law enforcement to identify individuals behind it.

CISA and FBI's recommended mitigations

The advisory's recommendations are organized around CISA's Cybersecurity Performance Goals (CPG) 2.0, a baseline set of practices CISA recommends across critical infrastructure sectors. Key recommendations include:

• Patch edge devices first. Prioritize vulnerabilities in CISA's Known Exploited Vulnerabilities catalog on internet-facing systems, VPNs and firewalls (CPG 2.B).
• Require multi-factor authentication across identity, credential and access management policies, especially for webmail, VPNs and accounts with access to critical systems (CPG 3.F).
• Enforce strong credential hygiene (CPG 3.B, 3.C, 3.E): passwords between 15 and 64 characters, hashed storage in password managers, no password reuse, account lockouts after repeated failed attempts, no password hints, and no mandatory periodic password changes more than once a year.
• Maintain offline, encrypted, immutable backups and regularly test restoration, with multiple recovery copies kept in physically separate, segmented locations (CPG 3.O, 3.K, 3.I, 1.C).
• Segment networks to limit lateral movement, and monitor traffic with EDR tooling to catch it when it happens (CPG 3.I, 4.B).
• Apply least privilege to admin accounts, using just-in-time, time-limited administrative access, and restrict command-line and scripting permissions (CPG 3.G, 3.M).
• Audit accounts regularly across domain controllers, servers, workstations and Active Directory for new or unrecognized accounts, and disable unused network ports.

The agencies also recommend validating these controls by testing against the specific MITRE ATT&CK techniques catalogued in the advisory, rather than assuming general best practices will catch SafePay-specific tradecraft. For organizations that suspect a compromise is already underway, the advisory points to CISA's Eviction Strategies Tool and recommends isolating affected hosts and threat-hunting before attempting remediation.

What organizations should do next

For security teams reading the advisory, the practical starting point is the CVE table above — confirm whether any internet-facing VPN, firewall or edge device in the environment is running software affected by those five CVEs, and patch or isolate it immediately if so. From there, the advisory's broader guidance is really a checklist of fundamentals that SafePay's own tradecraft shows are still frequently missing: MFA everywhere it can be enforced, backups that are actually offline and tested, and admin access that's audited rather than assumed.

Organizations that believe they may already be compromised, or that experience a SafePay intrusion, are encouraged to report it to the FBI via the Internet Crime Complaint Center (IC3), a local FBI field office, the U.S. Secret Service, or CISA directly at 1-844-Say-CISA or through its Incident Reporting System — regardless of whether a ransom is ultimately paid. Reporting feeds the same indicator-sharing pipeline that produced this advisory in the first place, and it's how CISA and the FBI build the next one. The full advisory, including indicators of compromise and MITRE ATT&CK mappings, is available on CISA's StopRansomware page.

The CVE pattern here also isn't unique to SafePay. Pandromeda has tracked a steady drumbeat of edge-device advisories this year, including a Cisco Secure Email Gateway vulnerability CISA flagged for immediate patching, and the pattern holds: ransomware crews are overwhelmingly walking through doors that patches already exist for, not building new ones.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage