SafePay ransomware walks in through remote access, so harden identity before backups
A joint advisory from the FBI, CISA, the UK's NCA and others says SafePay has hit at least 600 victims, mostly via stolen credentials and VPNs, then wipes backups. Close those doors first.
What happened
On 20 October 2026, CISA published advisory AA26-293A on SafePay ransomware, jointly with the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit. The advisory says SafePay has been active since August 2024 against businesses and critical infrastructure in North America, South America, Europe and Australia. It describes the group as among the most active ransomware groups in 2026, with at least 600 victims. The activity covered was observed in investigations, the most recent in August 2026.
The advisory sets out how the group operates:
| Stage | What the advisory describes |
|---|---|
| Initial access | Credential exposure, brute-force password attacks and VPN access abuse; phished account profiles; automated exploitation of internet-facing systems |
| Movement | PsExec, WinRM, remote management software, RDP and SMB admin shares; share enumeration to find data to steal |
| Theft | Data compressed with 7-Zip, WinRAR or RClone and sent out with tools such as WinSCP, RClone, FileZilla and the Backblaze command line, or OneDrive |
| Preparing to encrypt | Stopping Volume Shadow Copy Service and, in some cases, resetting network-attached backup devices to factory settings; in some cases all network-attached backups were deleted |
| Impact | Encryption with a hybrid scheme, a ransom note directing victims to a TOR chat portal, a demand for a share of company revenue in cryptocurrency, pressure phone calls and a leak site |
It also lists the vulnerabilities used. Two edge-device flaws, CVE-2020-3259 and CVE-2023-20269, were used together with phished accounts, and three others, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, were exploited against internet-exposed systems with automated scripts.
The advisory gives 15 mitigations, mapped to the CISA and NIST cross-sector performance goals. They include patching known exploited vulnerabilities with internet-facing systems first, multi-factor authentication on remote access, offline and immutable backups with tested restoration, network segmentation, network monitoring and endpoint detection, auditing administrator accounts, just-in-time administrator access and restricting scripting. It advises against paying a ransom. Indicators of compromise are published as STIX files.
Why it matters
The front door is identity and remote access. Three of the group's entry methods, stolen credentials, brute force and VPN abuse, depend on remote access that lacks strong authentication or monitoring. That is cheaper to fix than most security programmes assume, and it is where we would start.
Old flaws are still in use. Several of the listed vulnerabilities date from 2020 to 2024. The advisory points to unpatched internet-facing systems as a route in, long after fixes exist.
Backups are an attack target. The group stops shadow copies and resets or deletes network-attached backups before encrypting. A backup that is reachable from the same network and the same administrator credentials as production is not a recovery plan. The advisory's call for offline, immutable and tested backups answers this directly.
The tools are ordinary. The advisory notes that tools in its list should not be treated as malicious without evidence of use by the actor. Attackers use PsExec, remote access software and file-transfer tools that your own administrators use. Detection has to rest on who ran them, from where and when, not on the tool's name.
What we would do
- Inventory every remote access path. VPNs, remote desktop, remote management software and vendor access. Close the ones nobody can justify, and put them behind multi-factor authentication.
- Patch the edge first. Check internet-facing devices against the five listed CVEs and against CISA's known exploited vulnerabilities catalogue, and set a deadline for anything outstanding.
- Make backups survive an administrator compromise. Keep at least one copy offline or immutable, outside your normal credentials, and restore from it on a schedule so you know how long it takes.
- Alert on the behaviours. Watch for new administrator accounts, shadow copy deletion, backup device resets, large outbound transfers to cloud storage, and remote management software installed on servers.
- Reduce what an administrator account can do. Use just-in-time access, remove standing domain administrator rights, and restrict scripting and command-line tools where you can.
- Search for the published indicators. Run the STIX indicators against your logs, but do not assume absence means safety, because the tooling is generic.
- Rehearse the first day. Decide who isolates hosts, who talks to the authorities, and who has authority on payment, and keep the advisory's incident response steps to hand.
The advisory is useful because it is dull. Nothing in it needs a new product, only the basics done properly, in the order an attacker would meet them.
Questions we are asked
Is SafePay a threat to UK organisations?
The advisory says the group has targeted businesses and critical infrastructure in North America, South America, Europe and Australia, and the UK National Crime Agency is among the authoring agencies. It says the group has impacted at least 600 victims. The advisory does not name sectors, so assume any organisation with internet-facing remote access is a possible target.
Do we need to buy anything new to respond?
Probably not first. Most of the advisory's recommendations are configuration and discipline, such as multi-factor authentication on remote access, patching internet-facing systems, segmentation, least-privilege administration and tested offline backups. Check these are in place and working before you consider new tooling, and use the advisory's indicators to search your logs.
Should we pay if we are hit?
The agencies advise against paying, because payment does not guarantee recovery. The decision is also a legal and commercial one, so prepare it in advance with legal advice, your insurer and your board, and report incidents to the authorities. The best protection is a tested recovery that makes the question less urgent.