Federal investigators say the SafePay ransomware gang has hit at least 600 organizations since August 2024, and its operators often wipe the backups victims would need to recover. The warning is a joint advisory numbered AA26-293A, published October 20, 2026, and security outlets picked it up on Wednesday. Its partners include the FBI, CISA and the US Secret Service, plus three international agencies.
What the joint advisory says about SafePay ransomware
The advisory is a multi-agency product. Besides CISA and the FBI, the Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit are named as partners, according to Tech Insider. Federal authorities say SafePay has affected organizations in North America, South America, Europe and Australia since August 2024, across several critical infrastructure sectors, BleepingComputer reported.
The advisory belongs to a standing series. Shattered.io notes that federal ransomware advisories under the StopRansomware program publish technical breakdowns of active groups, so this document is written for defenders who need to act.
The FBI's framing is the sharpest line in the coverage. FBI Assistant Director Brett Leatherman said, as quoted in Shattered.io's write-up: "SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors." CISA's statement, as BleepingComputer reported it, called SafePay "one of the most active ransomware groups."
Researchers had flagged this group before the advisory. eSecurityPlanet reports that earlier leak-site analysis pointed to SafePay's focus on small and midsize businesses. Read together with the advisory's critical infrastructure language, that suggests a group that does not limit itself to one class of victim.
How SafePay ransomware gets inside
Initial access, according to GBHackers' summary of the advisory, comes from exposed or guessed credentials, phishing, brute-force attacks and internet-accessible vulnerable systems. Coverage also highlights VPN services and other internet-facing security devices as a route in. Investigators saw connections from Mullvad VPN addresses, along with compromised account profiles and automated exploitation scripts.
Five CVEs are named as initial-access vulnerabilities:
- CVE-2020-3259
- CVE-2023-20269
- CVE-2023-27532
- CVE-2024-40711
- CVE-2024-40766
The age of that list is the most uncomfortable detail. The IT Nerd says the newest of the five dates to September 2024, while the oldest was patched more than six years ago. An attacker can still use a flaw fixed long ago if one appliance or server never received the update. That makes this an inventory problem as much as a patching problem.
The sources also disagree on scope. eSecurityPlanet reports automated scripts exploiting Veeam Backup & Replication and SonicWall SonicOS flaws, while the advisory's CVE list has five entries. Security teams should treat both as patch scope rather than picking one list.
Edge devices show up in other ransomware cases too. The Register reports that Unit 42 links a PAN-OS flaw, CVE-2026-0257, to Qilin and Inc ransomware. CISA added that flaw to its Known Exploited Vulnerabilities catalog on May 13, 2026. Security Online describes crews using an authentication bypass to open VPN sessions and get around MFA. The sources do not establish any link between SafePay and that PAN-OS activity, so treat it as a shared pattern, not a confirmed connection. USA 24 has also covered how PEERSTITCH malware reached 500 FortiGate firewalls through a FortiOS flaw.
Why backup destruction changes the math
Decryption Digest reports that before encrypting, SafePay operators reportedly factory-reset network-attached storage devices, deleted shadow copies and stopped backup agent processes. Those steps remove the usual way out. A victim with clean, separate backups can rebuild. A victim whose backups sit on the same network, behind the same admin credentials, may face a choice between paying and starting from scratch.
Ransom payment does not guarantee recovery, and authorities urge victims to report incidents to law enforcement, according to BleepingComputer. That advice carries more weight when backups are a target. Paying buys no certainty when the recovery path itself has been removed.
How the intrusion moves through a network
Once inside, operators use PsExec, Windows Remote Management and Remote Desktop Protocol to run commands and move sideways. They also use a tool called ShareFinder.ps1 to map network shares, which shows them where files and backups live before anything is encrypted. Extortion includes phone calls to victims and publication of stolen data on a leak site if payment is refused.
The group's structure is unusual. Decryption Digest describes SafePay as a non-RaaS operation that runs every stage in-house, without affiliates. Many ransomware groups rent their tools to affiliates who do the intrusions. SafePay owning every step means defenders can focus on one set of tools and tactics across victims.
Other 2026 groups use the same pressure. USA 24 has reported on Storm's claim against Merit Financial Group and N0n's listing of Finzly Corp on its leak site. Both cases show the same tactic: a public claim that puts a company's name in front of customers and regulators.
Counting the 600 organizations
Every outlet repeats the 600 figure, but the verbs differ. Some coverage describes the victims as compromised, while Leatherman's quote uses "targeted." The distinction matters. A targeted organization was attacked or probed, while a compromised one was breached. Readers should treat 600 as a minimum count of organizations and check which verb a given article uses.
The advisory also leaves gaps. According to Tech Insider, it does not name victims, offer a sector-by-sector breakdown or disclose ransom amounts demanded or paid. Without those details, organizations cannot tell from public material whether their own sector is a focus.
What defenders should do this week
The steps below come from the advisory and its coverage, with one addition from us.
- Patch the five exploited CVEs on exposed systems, starting with CVE-2024-40711. Include VPN gateways, remote access tools and backup servers in the inventory.
- Enforce multifactor authentication on VPNs, remote access and every administrator account.
- Restrict administrative privileges, and limit PsExec, WinRM and RDP to the hosts that truly need them.
- Segment networks so backup systems sit apart from general user networks.
- Keep offline, encrypted, immutable backups, and test restores on a regular schedule.
- Block the indicators of compromise listed in the advisory, and review logs for connections from Mullvad VPN addresses.
- Give NAS devices and backup agents separate credentials, so one stolen admin password cannot reset the device or stop the agent. This step is our recommendation.
- If you suspect a compromise, report it to law enforcement rather than relying on payment alone.
What to watch next
The advisory opens a process rather than closing one. Watch for updated indicators from the agencies and for any revision that clarifies whether the 600 figure means compromised or targeted. Watch whether SafePay activity surfaces on the PAN-OS flaw that Unit 42 ties to other gangs. Also watch whether the older CVEs keep appearing in intrusions. An exploit from years back that still works tells defenders exactly where their inventories and patch cycles are failing.
