A joint advisory from CISA, the FBI, the U.S. Secret Service, and law enforcement agencies in Germany and the UK has revealed that the SafePay ransomware group has compromised at least 600 organizations across critical infrastructure sectors since August 2024. The advisory, designated AA26-293A, paints a picture of one of the most prolific and operationally disciplined ransomware operations currently active — one that has quietly filled the vacuum left by the takedowns and disruptions of LockBit and ALPHV/BlackCat.
What Is SafePay?
SafePay first appeared in August 2024 and has since grown into one of the most active ransomware groups in the threat landscape. Unlike many ransomware-as-a-service (RaaS) operations, SafePay operates as a closed, private group without affiliates — meaning a tight-knit team manages every phase of the attack chain, from initial access through data exfiltration and encryption.
The group employs a double-extortion model. After infiltrating a network, SafePay operators systematically steal sensitive documents before deploying their encryptor. Victims who refuse to pay face having their data published on SafePay’s leak site. The group has also been observed phoning victims directly to increase pressure — a tactic borrowed from the playbooks of now-disrupted groups. Ransom demands are typically calculated as a percentage of the victim’s revenue and must be paid in cryptocurrency.
SafePay’s encryption engine uses a hybrid scheme combining ChaCha20, a high-speed stream cipher, with RSA public-key cryptography. This combination makes decryption without the private key computationally infeasible. Once encryption is complete, a ransom note directs victims to a Tor-based chat portal where they authenticate with a unique victim ID.
How SafePay Gets In
The advisory highlights several initial access vectors that SafePay favors. Exposed or compromised credentials are the most common entry point, obtained through credential-stuffing attacks, brute-force campaigns, and phishing. Investigators have also traced attack traffic to IP addresses associated with the Mullvad VPN service — though the advisory clarifies that Mullvad itself was not breached and was simply used as an anonymization layer.
SafePay operators actively exploit known vulnerabilities in internet-facing devices. The advisory specifically calls out five CVEs:
CVE-2020-3259 and CVE-2023-20269 — flaws in Cisco ASA and Firepower Threat Defense (FTD) appliances that allow unauthorized access.
CVE-2023-27532 and CVE-2024-40711 — vulnerabilities in Veeam Backup & Replication, a widely deployed backup solution. Compromising backup infrastructure is a deliberate strategy: it eliminates the victim’s primary recovery path.
CVE-2024-40766 — a flaw in SonicWall’s SonicOS, which powers the company’s firewalls and VPN appliances.
Automated scripts are used to scan for and exploit these vulnerabilities at scale, particularly the Veeam and SonicWall flaws. Critically, none of these vulnerabilities are new — they have had patches available for months or years. Organizations that have not applied them remain exposed.
Living Off the Land
Once inside a network, SafePay’s operators demonstrate a high degree of operational stealth. They rely heavily on legitimate system administration tools for lateral movement — PsExec, Windows Remote Management (WinRM), Remote Desktop Protocol (RDP), and commercial remote monitoring and management (RMM) software. Because these tools are part of normal IT operations, the malicious activity blends into routine network traffic and can evade traditional signature-based detection.
Before deploying the encryptor, SafePay disables security software and takes deliberate steps to eliminate recovery options. Windows Volume Shadow Copies are deleted. Network-attached storage (NAS) devices holding backups are reset to factory defaults. Data exfiltration is conducted using off-the-shelf utilities including FileZilla, RClone, WinRAR, 7-Zip, and even Microsoft OneDrive.
The advisory notes that SafePay uses software packing and virtual machine–based code protection to make analysis of its tools more difficult for defenders and researchers.
Scale and Impact
The 600-organization figure cited in the advisory is almost certainly an undercount. SafePay’s leak site lists only victims who refuse to pay, meaning the total number of compromised organizations is likely significantly higher. Victims span North America, South America, Europe, and Australia, with a particular concentration in Germany — BlacKite research from mid-2026 identified Germany as a focus area for the group.
SafePay was ranked the third most active ransomware group during the first four months of 2026 and claimed the most attacks of any group in May 2026 with 70 incidents, according to NCC Group’s threat pulse data. The group appears to favor small and midsize businesses, though critical infrastructure operators are clearly within its scope.
One of the most high-profile incidents attributed to SafePay is the November 2024 breach of Conduent, a major U.S. business services firm. The attack exfiltrated personal and healthcare data, and on October 16, 2026 — just days before the advisory’s release — Conduent agreed to pay $80 million to settle a related class-action lawsuit.
What You Should Do
The advisory’s recommendations center on hardening the exact attack surfaces that SafePay exploits. Here are the key actions for defenders:
Patch edge devices immediately. Prioritize the five CVEs listed above, and review CISA’s Known Exploited Vulnerabilities (KEV) catalog for any additional unpatched flaws in your environment. If a VPN appliance, firewall, or backup system is running a vulnerable version, treat remediation as urgent.
Enforce multifactor authentication everywhere. Stolen credentials are SafePay’s primary entry method. MFA on VPN access, email, administrative consoles, and backup management interfaces significantly raises the bar.
Audit privileged accounts. Look for newly created accounts, dormant accounts with elevated privileges, and authentication anomalies — especially in off-hours or from unexpected geolocations.
Harden backups. Maintain offline, immutable backup copies that are not accessible from the production network. Regularly test restoration procedures. Restrict and monitor access to backup management platforms like Veeam.
Monitor for living-off-the-land activity. Baseline normal usage of tools like PsExec, WinRM, RDP, and RMM software. Alert on anomalous patterns — for example, PsExec executing from an account that has never used it before, or RClone appearing on a server for the first time.
Segment your network. Limit lateral movement by segmenting critical systems and restricting communication paths between network zones.
Report incidents. The advisory emphasizes that paying a ransom does not guarantee data recovery. Victims are urged to report incidents to the FBI, CISA, or the U.S. Secret Service, as well as to relevant international agencies.
The Bigger Picture
SafePay’s rise illustrates a recurring pattern in the ransomware ecosystem: when major groups are disrupted — as LockBit and ALPHV/BlackCat were — the operators, tools, and expertise do not vanish. They migrate, rebrand, and reconstitute. Security researchers have noted that SafePay emerged during the same period that both LockBit and ALPHV were experiencing law enforcement pressure, and the group has steadily absorbed market share since.
The joint, multi-national nature of this advisory — involving six agencies across three countries — signals the seriousness with which governments view SafePay. For organizations in critical infrastructure, the message is clear: if you haven’t already audited your VPN appliances, backup systems, and credential hygiene against this specific threat, the time to act is now.
Leave a Reply