Answer Brief
The FBI, CISA, the USSS, and allied German and U.K. authorities released a joint cybersecurity advisory on SafePay ransomware. Active since August 2024, the group has impacted at least 600 separate victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia using credential theft, edge-device exploits, living-off-the-land tools, and hybrid encryption.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
CISA, FBI, USSS, and German and British law enforcement publish joint cybersecurity advisory AA26-293A.
Executive Summary: The FBI, CISA, the USSS, and allied German and U.K. authorities released a joint cybersecurity advisory on SafePay ransomware. Active since August 2024, the group has impacted at least 600 separate victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia using credential theft, edge-device exploits, living-off-the-land tools, and hybrid encryption.
Why It Matters
A joint cybersecurity advisory released by CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the U.K. National Crime Agency, and the North West Regional Organised Crime Unit outlines the widespread operational footprint of the SafePay ransomware group. Operational since August 2024, SafePay was identified as among the most active ransomware operations in 2026, impacting at least 600 separate victims spanning multiple critical infrastructure sectors across North America, South America, Europe, and Australia.
The group establishes initial access through multiple vectors, combining credential abuse, brute force password attacks, and the exploitation of external remote services. SafePay actors route traffic through IP addresses associated with VPN provider Mullvad and use phished account profiles to access victim networks and target edge devices. Identified entry flaws include CVE-2020-3259 and CVE-2023-20269, alongside automated scripts that scan internet-exposed systems for CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
Technical Signal
Once inside victim perimeters, SafePay actors prioritize living-off-the-land techniques to blend in with legitimate administrative workflows. Persistence is maintained by obtaining administrative privileges on existing accounts or creating new accounts. To execute commands across remote endpoints, the actors deploy living-off-the-land binaries including PsExec and Windows Remote Management. Reconnaissance of internal file shares is conducted using specialized discovery tools such as ShareFinder.ps1 and SharpShares.exe.
Defense evasion and privilege escalation form an integral component of the group's post-compromise routine. SafePay operators apply User Account Control bypass techniques through Component Object Model objects and leverage token impersonation to escalate execution privileges. Before initiating lateral movement, actors disable security software to evade detection, deploy software packing or virtual machine software protection to conceal payloads, and in select cases alter system passwords to lock out legitimate administrators.
Operational Impact
Lateral movement relies heavily on built-in network administration tools and remote management software, including Remote Desktop Protocol, PsExec, and WinRM. To collect and stage sensitive corporate files, actors repurpose legitimate compression and transfer utilities, including 7-Zip, FileZilla, RClone, WinSCP, and WinRAR. Data exfiltration channels observe transfers to actor-controlled repositories hosted on cloud providers such as OneDrive and Backblaze B2, as well as the unauthorized installation of AnyDesk and TeamViewer to stage payloads.
SafePay enforces severe impact by directly thwarting standard recovery mechanisms prior to payload execution. Actors intentionally stop the Windows Volume Shadow Copy Service and reset Network Attached Storage devices containing enterprise backups back to original factory defaults. The ransomware then executes a hybrid encryption routine combining a ChaCha20 stream cipher with an RSA public-key cryptosystem, appending the .SafePay extension to encrypted files and rendering unencrypted recovery impossible without the threat actor's private key.
What To Watch
Extortion pressure involves a combination of digital and direct outreach. SafePay leaves a ransom note across compromised hosts directing victims to a Tor-hosted negotiation portal. To intensify pressure on victim leadership, representatives make telephone calls on behalf of the ransomware group. If payments demanded in cryptocurrency are refused, the operators publish exfiltrated corporate records on the public SafePay data leak website.
Defensive teams, operational technology owners, and vulnerability analysts must align their perimeter defenses against the specific CVEs and access pathways highlighted in the advisory. Recommended mitigations emphasize enforcing multifactor authentication across all external access points, auditing administrative privileges with just-in-time access, disabling unnecessary command-line execution, and keeping immutable, physically segmented offline backups to protect resilience against automated backup resets.
Event Type: security
Importance: high
Affected Sectors
- critical infrastructure
- government
Key Numbers
- separate victims: at least 600
Timeline
- CISA, FBI, USSS, and German and British law enforcement publish joint cybersecurity advisory AA26-293A.
Frequently Asked Questions
What is SafePay ransomware and who published the advisory?
SafePay is a ransomware operation active since August 2024 that targets businesses and critical infrastructure. The joint advisory AA26-293A was published by the FBI, CISA, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the U.K. National Crime Agency, and the North West Regional Organised Crime Unit.
Which vulnerabilities do SafePay threat actors exploit for initial access?
SafePay actors exploit known edge-device flaws using phished account profiles, including CVE-2020-3259 and CVE-2023-20269. The authoring agencies also observed the group using automated scripts across internet-exposed systems to exploit CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
How does SafePay inhibit system recovery and enforce extortion?
SafePay actors halt the Volume Shadow Copy Service and reset Network Attached Storage containing backup data to initial factory settings. After encrypting files with ChaCha20 and RSA algorithms, actors demand cryptocurrency, conduct pressure phone calls, and threaten to release data on a dedicated leak site.