FBI and CISA Joint Advisory Exposes SafePay Ransomware Campaign Against 600 Organizations

The October 2026 joint advisory from the FBI, CISA, the U.S. Secret Service, and international law enforcement partners has pulled back the curtain on SafePay, a ransomware operation responsible for compromising at least 600 organizations across critical infrastructure sectors since August 2024. The advisory, designated AA26-293A, represents one of the most detailed technical dismantlings of an active ransomware group issued this year, and it arrives at a moment when global ransomware attacks are surging at record pace.

The SafePay Threat Profile

SafePay first appeared in mid-2024 and quickly filled the vacuum left by the decline of major ransomware franchises such as BlackCat and LockBit. Unlike many prominent ransomware groups that operate through affiliate models, SafePay runs as an independent operation without external affiliates. This self-contained structure has allowed the group to maintain tight operational security while executing attacks across North America, South America, Europe, and Australia.

According to the joint advisory, SafePay has impacted at least 600 separate victims spanning multiple critical infrastructure sectors. The group’s reach extends across healthcare, government, financial services, and manufacturing, making it one of the most active ransomware operations identified by federal authorities in 2026.

Initial Access Techniques

The advisory details how SafePay threat actors obtain initial access to victim networks through several distinct methods:

• Credential exposure — Stolen account credentials obtained through phishing and underground marketplaces
• Brute force password attacks — Automated scripts targeting weak or commonly used passwords
• VPN exploitation — Compromised virtual private network connections, particularly using Mullvad VPN IP addresses to conceal attacker origins
• Known vulnerability exploitation — Targeting unpatched edge devices and internet-facing infrastructure

Investigators identified five specific CVEs associated with SafePay intrusion activity: CVE-2020-3259 and CVE-2023-20269 affecting Cisco VPN products, CVE-2023-27532 impacting Veeam backup software, CVE-2024-40711 involving Veeam access control, and CVE-2024-40766 affecting SonicWall secure mobile access. These vulnerabilities span information exposure, authentication bypass, deserialization flaws, and access restriction weaknesses, all of which provide attackers with entry points into exposed systems.

Inside the Attack Chain

Once inside a network, SafePay operators rely on legitimate Windows administration tools rather than specialized malware, making their activity significantly harder to detect with traditional security monitoring. The advisory documents the group’s use of PsExec, WinRM, RDP, and PowerShell for lateral movement between systems. A PowerShell script called ShareFinder.ps1 helps attackers identify shared folders and locate valuable data for exfiltration.

Credential theft plays a central role in SafePay’s post-exploitation activities. The group uses Mimikatz to extract credentials from compromised systems, while AnyDesk and TeamViewer provide persistent remote access capabilities. For data exfiltration, SafePay employs a range of tools including FileZilla, RClone, WinSCP, and even Microsoft OneDrive, demonstrating how attackers increasingly leverage legitimate cloud storage platforms to blend their activity with normal business operations.

Encryption and Extortion Model

SafePay deploys ransomware that encrypts files using a combination of ChaCha20 stream cipher and RSA cryptographic technology for key exchange. The malware can perform full or partial encryption depending on file type and size, and affected files receive the .SafePay extension. According to the advisory, data encrypted with the SafePay variant cannot be recovered without the decryption key.

The group operates on a double-extortion model, stealing data before encrypting systems and threatening to publish stolen information publicly if victims refuse to pay. After encryption, SafePay leaves ransom notes on victim desktops or root directories, directing victims to communicate through a Tor-based chat portal using a unique victim identifier. The group demands cryptocurrency payments, typically calculated as a subset of the victim organization’s revenue.

Beyond digital pressure tactics, SafePay representatives make direct telephone calls to victims to apply additional psychological pressure. The advisory also documents how the group deletes Volume Shadow Copies and resets network-attached backup devices to factory settings, effectively eliminating standard recovery options before victims even realize they have been compromised.

The Broader Ransomware Surge in 2026

The SafePay advisory lands against a backdrop of unprecedented ransomware growth. Check Point Research reported a 53 percent year-over-year increase in ransomware attacks for September 2026, with organizations absorbing an average of 2,803 cyberattacks per week globally. Fortinet’s 2026 Global Threat Landscape Report counted 7,831 confirmed ransomware victims, compared with roughly 1,600 in its 2025 report, representing a 389 percent year-over-year increase.

Separate research from Semperis adds another dimension to the threat landscape. The 2026 Semperis Ransomware Risk Report surveyed 1,200 IT and security professionals across nine countries and found that 84 percent of ransomware attacks involved artificial intelligence. Even more concerning, 44 percent of victims experienced attacks where cybercriminals weaponized the organization’s own AI systems against them. The report also found that 40 percent of attacks involved psychological or physical threats against staff, with 37 percent involving threats against employees’ family members.

Critical Mitigation Recommendations

The joint advisory provides specific mitigation guidance for organizations seeking to reduce their exposure to SafePay and similar ransomware operations:

• Patch internet-facing devices immediately — Prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog, especially VPNs, firewalls, and backup systems
• Enable multi-factor authentication — Implement MFA for all VPN access, webmail, and accounts that access critical systems
• Restrict administrative tool access — Limit the number of accounts permitted to use tools like PsExec, WinRM, and PowerShell, since SafePay relies on legitimate utilities for lateral movement
• Maintain offline encrypted backups — Keep backups offline, encrypted, and immutable so attackers cannot access, modify, or delete them during an intrusion
• Monitor for Mullvad VPN IP addresses — Security teams should flag unusual login attempts originating from Mullvad VPN infrastructure, as SafePay consistently uses this provider for initial access
• Implement network segmentation — Separate critical systems from general network traffic to limit lateral movement opportunities once an attacker gains entry

The Identity Infrastructure Gap

The Semperis report highlights a critical vulnerability that SafePay and other groups consistently exploit: 87 percent of ransomware attacks targeted identity systems such as Active Directory, Entra ID, and Okta, yet only half of organizations maintain dedicated identity backup systems. This gap represents one of the most significant blind spots in enterprise security posture, as compromise of identity infrastructure effectively grants attackers the keys to the entire network.

Organizations should treat identity infrastructure as a primary security boundary, not merely an IT administration tool. This means implementing dedicated backup for directory services, monitoring for suspicious credential activity, and maintaining separation between administrative and standard user accounts.

The Supply Chain Dimension

Recent incidents underscore how ransomware groups increasingly target upstream vendors rather than individual organizations. The ConnectWise Cloud Backup breach, where compromised application credentials provided access to 173 Microsoft 365 tenants, demonstrates how a single vendor compromise can cascade across hundreds of downstream customers. SafePay’s exploitation of Veeam vulnerabilities follows the same pattern, targeting backup infrastructure that organizations depend on for recovery.

Organizations must audit third-party application credentials with the same scrutiny applied to employee accounts. The backup layer itself has become a primary target, and defenders can no longer treat it as a passive recovery mechanism. Assume that any vendor with broad access to your environment is a potential attack vector, and implement monitoring and access controls accordingly.

Looking Ahead

The SafePay advisory serves as both a warning and a playbook for defenders. The group’s reliance on known vulnerabilities, stolen credentials, and legitimate administration tools means that most attacks are preventable through basic security hygiene. The challenge is not a lack of defensive tools but the gap between what organizations know they should do and what they actually implement.

With ransomware attacks surging 53 percent year-over-year and 124 active extortion groups operating globally, the threat is not diminishing. Organizations that prioritize patching, enforce multi-factor authentication, harden identity infrastructure, and maintain immutable backups will be significantly better positioned to withstand the next wave of attacks. Those that do not will likely find themselves on a leak site, negotiating with criminals through a Tor portal.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous