On 20 October 2026 the FBI, CISA, the U.S. Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency and the UK’s North West Regional Organised Crime Unit published a joint #StopRansomware advisory on SafePay. Source: CISA advisory AA26-293A. Everything below comes from that page unless stated otherwise.
The headline number
The advisory says SafePay has been active since August 2024, targets businesses and critical infrastructure in North America, South America, Europe and Australia, and has affected “at least 600 separate victims” across “multiple critical infrastructure sectors”. It describes SafePay as among the most active ransomware groups of 2026.
Two caveats. First, the advisory does not name the sectors, so we cannot say which are hit hardest. Second, “at least 600” is the agencies’ figure; we have not seen the underlying victim list. For context, our June 2026 profile of SafePay cited more than 400 claimed victims, so the agencies’ number is higher, though the two figures come from different sources and may not measure the same thing.
How they get in
The advisory lists several routes:
- Stolen or guessed credentials, brute force and phished accounts.
- VPN abuse, including connections from Mullvad VPN IP addresses.
- Exploitation of public-facing edge devices and other internet-exposed systems.
Five CVEs are listed: CVE-2020-3259 and CVE-2023-20269 (described as exploited against edge device products), and CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 (described as exploited across internet-exposed systems). The page we read did not name the affected products or vendors, so check the advisory or your vendor’s bulletin before triaging. The advisory does not mention initial access brokers; that is a statement about the page, not evidence either way about SafePay’s supply chain.
Inside the network
Once in, the agencies describe a fairly conventional but effective playbook:
- Privilege and persistence: admin rights on existing or new accounts, UAC bypass and token impersonation.
- Defence evasion: disabling security software, changing user passwords to lock out legitimate logins, and packed binaries.
- Lateral movement: PsExec, WinRM, RDP and SMB admin shares, with share discovery via ShareFinder.ps1 and SharpShares.exe.
- Exfiltration: 7-Zip, WinRAR, RClone, WinSCP and FileZilla, sometimes OneDrive, plus AnyDesk or TeamViewer for remote access.
Impact and extortion
Files are encrypted with a hybrid ChaCha20/RSA scheme and given the .SafePay extension. The group stops Volume Shadow Copy and resets NAS devices to factory settings, which is a nasty detail for anyone relying on NAS-held backups. Extortion is double: stolen data goes to a leak site if the victim does not pay, and a representative phones victims to add pressure. The group “typically demand[s] a subset of company revenue” in cryptocurrency. The note points victims to a Tor chat portal using a victim ID as the login. The advisory gives no specific ransom figures, and we are not stating any.
Indicators
The advisory publishes roughly nine IP addresses, a number of file names, four SHA-1 and six SHA-256 hashes and four hostnames, observed from November 2024 to August 2026. The authors warn that some listed tools are legitimate and IPs may be reassigned, so verify before blocking. We have not reproduced them here; take them from the STIX XML and JSON files on the advisory page.
What to do this week
The agencies’ highlighted mitigations map neatly onto the observed behaviour:
- Patch known exploited vulnerabilities on internet-facing systems first, and check the five CVEs above against your estate.
- Enforce MFA on VPNs, webmail and critical-system accounts, with account lockouts after repeated failures.
- Keep encrypted, immutable, offline backups and test restores. Given the NAS resets, do not treat an on-network NAS as your offline copy (our inference, not the advisory’s wording).
- Segment networks and run EDR to catch lateral movement and tools such as RClone.
- Audit admin accounts, apply least privilege and restrict command-line and scripting use.
If encryption has not started, the advisory recommends isolating hosts, hunting for activity and reporting to the FBI (IC3), a local FBI or USSS field office, or CISA. The agencies do not encourage paying.
Still unverified
We have not independently verified the 600 figure or any victim identities. No other secondary coverage was opened for this piece, so treat our reading as a summary of the primary advisory only.