SafePay ransomware hits over 600 organizations via compromised VPNs and backup servers

SafePay ransomware has impacted at least 600 distinct victims across multiple critical infrastructure sectors, according to a joint government advisory published on October 20, 2026.

The group has been active since August 2024 and has targeted businesses and essential services in North America, South America, Europe, and Australia, making it one of the most active ransomware threats in 2026.

Attacks commonly combine stolen credentials, exposed remote-access services, and exploitation of known software vulnerabilities. After gaining initial access, operators take control of accounts, search for and exfiltrate valuable data, disable or corrupt recovery systems, and then encrypt files.

This sequence creates pressure from operational disruption and from threats to publish stolen information.

The advisory was issued by CISA and partner agencies and reflects investigations through August 2026. Contributors include the FBI, the United States Secret Service, German investigators, and UK law enforcement. Their findings describe an operation that relies heavily on trusted accounts and standard administrative tools.

SafePay Ransomware Has Affected 600+ Organizations

SafePay operators gain access through exposed credentials, brute-force or credential-stuffing attempts, phishing, and vulnerable internet-facing systems. Prior reporting on SafePay highlighted attacks against RDP and VPN services using compromised remote connections.

The advisory adds details about automated exploitation and abuse of phished account profiles to move into victim networks.

Observed exploitation includes CVE-2020-3259 and CVE-2023-20269 in edge devices, along with CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 in internet-exposed systems.

Investigators also observed connections originating from Mullvad VPN addresses; this indicates the service was used during intrusions, but does not imply Mullvad itself was compromised or that regular Mullvad customers are linked to SafePay.

Backup infrastructure is a frequent target. CVE-2024-40711 affects Veeam Backup & Replication and permits unauthenticated remote code execution. Past ransomware incidents combined compromised VPN access with this vulnerability to create administrative accounts. Those incidents involved other ransomware families and demonstrate a shared weakness rather than a direct link between groups.

After initial access, operators create new accounts or elevate permissions on existing ones. They use PsExec, Windows Remote Management (WinRM), and Remote Desktop Protocol (RDP) to execute commands and move laterally. Because these utilities are also used for legitimate administration, defenders should investigate who launched them, where they ran, and whether their use is consistent with authorized activity.

Attackers search shared folders for sensitive data, disable security products, and sometimes change user passwords to lock out legitimate staff. Investigators observed UAC bypasses and reuse of security tokens to gain higher privileges. Code packing obscures malicious binaries, and remote-support applications are abused to deploy malware.

For data theft, SafePay operators use common tools such as 7-Zip, WinRAR, RClone, WinSCP, and FileZilla. Some intrusions involved OneDrive or Backblaze storage for exfiltrated data. These tools are not inherently malicious; indicators of compromise include unexpected installation or execution, unusual data transfer patterns, and connections to accounts outside the organization, especially when seen alongside other signs of compromise.

Because the group targets recovery capabilities, attacks are particularly disruptive. Operators stop the Volume Shadow Copy Service and have reset network-attached storage appliances holding backups to factory settings. Related reporting on access-control vulnerabilities in remote-access appliances illustrates why securing remote access is critical before attackers reach internal systems and backup resources.

Following data theft, the ransomware encrypts files using ChaCha20 together with RSA. The malware can encrypt entire files or portions of files depending on type and size. Victims receive ransom notes directing them to a Tor-based chat portal; attackers also use phone calls and threats to publish stolen information. In some cases the malware removes itself after completing operations.

CISA and partner agencies recommend patching exposed systems, enforcing multifactor authentication, and restricting administrative privileges. Backup copies should be kept offline or otherwise protected from modification and deletion, and restoration procedures should be tested regularly. Network segmentation can limit the path from a compromised remote-access account to servers that host sensitive data and backups.

Security teams should investigate unfamiliar accounts, unexpected uses of remote-administration tools, disabled protections, and anomalous outbound transfers together rather than treating each alert in isolation. If an intrusion is suspected, isolate affected systems, preserve logs and evidence, and determine the scope of the compromise. The agencies discourage paying ransoms because payment does not guarantee recovery and may fund further criminal activity.

Indicators of Compromise (IoCs)

IP Addresses

Source: CISA advisory, Table 2.

SHA-1 Hashes

Source: CISA advisory, Table 4.

SHA-256 Hashes

Source: CISA advisory, Table 5.

Filenames and File Patterns

Source: CISA advisory, Table 3. These names require supporting evidence before being classified as malicious.

Hostnames and Encryption Marker

Note: IP addresses and domains are intentionally defanged (for example, [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.