On 20 October 2026, six agencies across three countries published joint advisory AA26-293A, part of the #StopRansomware series, detailing the SafePay ransomware operation.
The headline figure: at least 600 organisations across multiple critical infrastructure sectors compromised since August 2024, spanning North America, South America, Europe and Australia. CISA describes SafePay as one of the most active ransomware groups currently operating.
Two details make this advisory worth more than its victim count.
First, SafePay is not a ransomware-as-a-service operation. It emerged in August 2024 as a private group that does not work with affiliates, which is unusual for an operation at this scale and makes the 600 figure more striking rather than less.
Second, and more useful for defenders: the advisory names five exploited vulnerabilities, and all of them are old. There is nothing novel in SafePay's toolkit. It is succeeding on unpatched edge devices and missing multi-factor authentication.
What happened
Who published it
The advisory carries unusually broad authorship:
FBI
CISA
US Secret Service (USSS)
Germany's Landeskriminalamt Rheinland-Pfalz
UK National Crime Agency
UK North West Regional Organised Crime Unit
The technical content draws on FBI, USSS and German state police investigations conducted between November 2024 and August 2026. Brett Leatherman, assistant director of the FBI's cyber division, confirmed the 600-plus victim figure publicly.
Where SafePay came from
SafePay appeared in August 2024. From the start of 2025 it expanded into the space left by the collapse of BlackCat (ALPHV) and LockBit, two operations that dominated the ransomware landscape until law enforcement action and internal disruption removed them.
By May 2026, NCC Group assessed SafePay as the most active ransomware group that month, with 70 claimed attacks.
This progression is the real story of the advisory. Disrupting a major ransomware brand does not reduce the volume of ransomware. It redistributes it.
How they get in
The advisory lists a broad set of initial access methods:
Exposed or stolen VPN credentials, which remain the most reliable route into a corporate network
Phishing, including the use of phished account profiles to move into networks
Brute-force attacks against exposed services
Automated exploitation of known CVEs on edge devices and other internet-facing systems, run via scripts
The five vulnerabilities
CVE | Affected technology | Year |
|---|---|---|
CVE-2020-3259 | Cisco ASA and Firepower | 2020 |
CVE-2023-20269 | Cisco ASA and Firepower VPN | 2023 |
CVE-2023-27532 | Veeam Backup and Replication | 2023 |
CVE-2024-40711 | Veeam Backup and Replication | 2024 |
CVE-2024-40766 | SonicWall SonicOS | 2024 |
Look at the pattern rather than the individual entries. Three are in VPN and firewall appliances, the devices that sit at the network edge by design. Two are in backup software.
The oldest has been patchable since 2020. None of these is a zero-day. None required research. They were available, scanned for automatically, and found open.
The backup problem
This is the part that should change how you read the advisory.
SafePay deliberately targets backup infrastructure, and reporting on the advisory describes the group systematically destroying backups before encrypting files. Two of the five exploited CVEs are in Veeam Backup and Replication, which means the backup system can be both the way in and the thing destroyed.
This collapses the standard ransomware response plan. The usual advice, restore from backup and refuse to pay, assumes the backups survive the attack. Here, removing that option is an explicit objective, executed first.
Double extortion
SafePay exfiltrates sensitive data before encrypting systems and threatens to publish it if the ransom is not paid. Even an organisation that recovers cleanly still faces a data exposure problem.
The agencies state plainly that paying a ransom does not guarantee recovery of encrypted files.
What the advisory provides
Indicators of compromise, including file hashes, filenames such as
locker.dll, and IP addressesTactics, techniques and procedures observed across the investigation window
STIX-formatted intelligence for direct import into security tooling
A caution worth heeding: legitimate tools and historical IP addresses in the indicator list require contextual verification before blocking. Several indicators are dual-use, and blanket blocking will break things.
Why it matters
The barrier to entry was patch management, and it held for nobody. Six hundred organisations were reached using vulnerabilities disclosed between 2020 and 2024. This is not a story about sophisticated adversaries. It is a story about edge devices that nobody owns, nobody patches and nobody monitors.
Edge devices are the front door and the blind spot. VPN concentrators and firewalls are internet-facing by function, often excluded from endpoint tooling, frequently maintained by networking teams rather than security teams, and patched on a hardware vendor's schedule rather than a monthly cycle.
Your backup platform is a target, not a safety net. Treating Veeam or any backup system as infrastructure that merely needs to exist, rather than as a high-value asset that needs hardening, monitoring and isolation, is the gap SafePay exploits.
Takedowns redistribute rather than reduce. SafePay grew into the vacuum left by LockBit and BlackCat. Law enforcement disruption remains worthwhile, but planning on the basis that pressure on one group lowers your overall risk is a mistake.
A private group scaled to 600 victims. Without affiliates, the operational tempo is the group's own. That argues for a disciplined, well-resourced team rather than an opportunistic one, and it means the techniques in this advisory are likely to stay consistent rather than vary by affiliate.
Who is affected
Critical infrastructure operators across North America, South America, Europe and Australia, in multiple sectors.
Any organisation running Cisco ASA or Firepower, SonicWall SonicOS, or Veeam Backup and Replication at versions vulnerable to the five named CVEs.
Organisations with internet-facing VPN access that lacks multi-factor authentication, which the advisory identifies as a primary route in.
Mid-sized organisations generally, which tend to run exactly this class of edge appliance and backup software with limited patching capacity.
Anyone whose ransomware plan depends on restoring from backup, since backup destruction is part of SafePay's method.
What organisations should do
Patch the five, then the rest
Check immediately for CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 across your estate. These are confirmed in use against 600 victims.
Prioritise internet-facing systems first. The agencies point to the prioritisation framework in Binding Operational Directive 26-04 as the model to follow.
Track CISA's Known Exploited Vulnerabilities catalogue for edge device flaws as a standing process, since these are routinely the initial access route.
Identity
Enforce multi-factor authentication on every service that supports it, with the agencies specifically naming webmail, VPNs and any account that reaches critical systems.
Audit VPN accounts for dormant users, shared credentials and service accounts, and check whether any are exempted from MFA.
Restrict administrative privileges and separate admin accounts from daily-use accounts.
Protect the backups specifically
Treat your backup platform as tier-zero infrastructure. Patch it on the same urgency as a domain controller, place it on a separate management network, and require separate credentials to reach it.
Keep immutable or offline copies that cannot be deleted by a compromised administrator account.
Test restoration under the assumption that online backups are gone. If your recovery plan has never been exercised against that scenario, it is untested.
Alert on backup deletion and policy changes. Mass deletion of backup jobs is one of the clearest pre-encryption signals available, and it is often the last warning you get.
Architecture and detection
Segment networks so that reaching the edge does not mean reaching everything.
Ingest the STIX indicators from the advisory, but verify context before blocking. Some indicators are legitimate tools or historical addresses.
Monitor for automated scanning and exploitation attempts against edge devices, which is how SafePay operates at scale.
If you are compromised
Isolate affected hosts, preserve evidence, scope which accounts were compromised, and coordinate eviction rather than evicting piecemeal, per the advisory's incident response guidance.
Assume data was stolen before encryption. Plan the disclosure and regulatory workstream in parallel with recovery.
Understand that payment does not guarantee recovery, as the authoring agencies state explicitly.
Final thoughts
Six hundred organisations, four continents, two years, and not a single novel technique. SafePay got in through VPN credentials that should have required a second factor and through appliances that should have been patched when the vendor shipped the fix. Then it went looking for the backups.
The lesson: the ransomware groups causing the most damage right now are not out-thinking defenders, they are out-waiting them. Automated scripts scan continuously for the same handful of known flaws on internet-facing devices. The window between a patch being available and an organisation applying it is the entire business model.
The second lesson is the one that should prompt action this week. Your backup system is not your recovery plan if an attacker can reach it. SafePay's method is to remove the restore option first, and two of the five vulnerabilities it exploits are in backup software itself. A backup that a compromised administrator can delete is a convenience, not a control.
Two questions worth answering today: are any of those five CVEs still unpatched on your internet-facing devices, and could someone who compromised your domain admin account delete every copy of your backups?