Analysis
SafePay ransomware: CISA, FBI and partners warn of a group that has hit at least 600 organisations since August 2024
CISA, the FBI and partners in Germany and the UK issued joint advisory AA26-293A on October 20, describing how the SafePay group operates and the steps organisations should take.
At least 600 organisations in four regions of the world have fallen victim to the SafePay group since August 2024, and cybersecurity authorities in the United States and allied countries are now calling on businesses and critical-infrastructure operators to apply mitigation measures. CISA, the FBI and their partners published on Tuesday, October 20, 2026 the joint #StopRansomware cybersecurity advisory coded AA26-293A, which describes the group’s methods and protective measures.
SafePay is a ransomware group, meaning its malware encrypts an organisation’s files and demands money to decrypt them. The signatories describe it as one of the most active groups of its kind. Victims are in North and South America, Europe and Australia, and come from many critical-infrastructure sectors. The advisory is signed by the FBI, CISA and the US Secret Service (USSS), together with the Landeskriminalamt (state criminal investigation office) of Rhineland-Palatinate in Germany, and the UK’s National Crime Agency and North West Regional Organised Crime Unit. The information comes from investigations that ran until August 2026.
How the group operates
The actors use double extortion: they steal data, encrypt systems and threaten to publish what they took. If the victim does not pay, the data goes up on the group’s leak site. Ransoms are demanded in cryptocurrency and typically correspond to a share of the company’s revenue. The note is usually left on the desktop and leads to a chat portal on the Tor network, and in some cases a representative of the group phones victims to pressure them.
To get into the network, the actors exploit leaked passwords, run mass password-guessing (brute-force) attacks, and connect through VPN with IP addresses of the provider Mullvad. They also use accounts obtained through phishing. Another way in is vulnerabilities, that is, known security flaws, in edge devices such as firewalls and in other systems exposed to the internet, using automated scripts. The advisory lists five CVEs: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
Once inside, the actors create or take over accounts, move laterally through the network with legitimate tools such as PsExec, WinRM and RDP, and disable security software. They compress data with tools such as 7-Zip and WinRAR and send it to accounts under their control with WinSCP and RClone. To make recovery harder, they stop the Volume Shadow Copy Service and reset to factory settings the network-attached storage (NAS) devices that hold backups. Encrypted files get the extension .SafePay.
What the agencies recommend
The agencies ask organisations to update systems and software regularly, especially firewalls and other edge devices, prioritising known vulnerabilities already being exploited. They also call for applying Zero Trust, limiting administrative tools and privileges to those who need them, and strengthening accounts with identity, credential and access management (ICAM) policies and multi-factor authentication (MFA). The measures include passwords of 15 to 64 characters, offline, encrypted and immutable backups, and network segmentation.
The agencies do not encourage paying ransoms, because payment does not guarantee that files will be recovered. They ask victims to report incidents promptly to the FBI’s IC3, a local FBI or USSS office, or CISA, and to isolate compromised computers.