The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a joint advisory on October 20, 2026, detailing the activities of the SafePay ransomware group. The advisory states that SafePay actors have breached over 600 critical infrastructure organizations worldwide since August 2024. The threat actors have targeted businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay ransomware was identified as one of the most active ransomware groups in 2026.

SafePay actors typically gain initial access by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. The advisory notes that actors use IP addresses of the VPN provider Mullvad to attain initial access. They exploit specific known Common Vulnerabilities and Exposures (CVEs) for edge device products, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. Once inside the network, actors establish control by creating new accounts or taking over existing ones, using legitimate system tools to move through the network and disable security protections.

After gaining access, SafePay threat actors use built-in administrative tools consistent with living off the land (LOTL) techniques. They utilize binaries such as PsExec and Windows Remote Management (WinRM) to execute commands on remote systems. The actors also employ tools like ShareFinder.ps1 and SharpShares.exe to identify valuable assets for exfiltration. To avoid detection, they commonly disable security software and change passwords of system users. In some cases, they use software packing or virtual machine software protection to conceal their code.

SafePay actors use legitimate tools such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data. They use WinSCP and RClone to facilitate data exfiltration to actor-controlled accounts. In some instances, actors use OneDrive or install legitimate remote desktop tools like AnyDesk or TeamViewer to transfer ransomware. They halt the Volume Shadow Copy Service and reset Network Attached Storage to inhibit system recovery. Following exfiltration, they encrypt files using a hybrid encryption scheme combining ChaCha20 and RSA. The ransom note demands payment in cryptocurrency and threatens to post data on a leak website if payment is not made.

The advisory urges organizations to regularly patch and update systems, especially firewalls and other edge devices. Organizations are advised to implement Zero Trust principles and restrict administrative tools and privileges to necessary users only. Strengthening account security by implementing identity, credential, and access management (ICAM) policies and multifactor authentication (MFA) is recommended. The advisory includes indicators of compromise (IOCs) in STIX XML and JSON formats for download.

Sources

• CISA: SafePay ransomware hit over 600 critical infrastructure orgs
• #StopRansomware: SafePay Ransomware