CISA and FBI Issue Joint SafePay ransomware Advisory: 600 Victims, 5 Known Flaws
Six agencies published a joint SafePay ransomware advisory on October 20, 2026, warning that the group has hit at least 600 separate victims across US and allied critical infrastructure since August 2024, and naming the five known exploited vulnerabilities defenders should patch first. The advisory, labeled AA26-293A, comes from the FBI, CISA, the US Secret Service, Germany’s LKA Rheinland-Pfalz and two UK units, and it lands as SafePay has become one of the most active ransomware brands of 2026. Here is what the advisory says the group does, the exact flaws in play, and what a US organization should do this week.
Key Takeaways:
- – Joint advisory AA26-293A on SafePay ransomware was released October 20, 2026 by CISA, FBI, USSS and international partners.
- – SafePay has impacted at least 600 separate victims since August 2024, including businesses and critical infrastructure.
- – Five exploited flaws are named, all in edge and backup products: two Cisco ASA/FTD CVEs, two Veeam CVEs and one SonicWall SonicOS CVE.
- – Initial access usually comes from stolen or guessed passwords, plus brute force and phished account profiles.
- – Data is exfiltrated before encryption with RClone, WinSCP, FileZilla or Backblaze tools, then files are renamed with the .SafePay extension.
Who SafePay Is and How It Gets In
The advisory describes a mature operation rather than an opportunistic crew. SafePay actors have been highly active since August 2024, and the authors say the group typically gains access by stealing or guessing passwords. Techniques listed include brute forcing (T1110) and use of phished account profiles, along with VPN access sourced from IP addresses belonging to the Mullvad provider, a detail that means seeing Mullvad egress on a VPN log is not automatically benign in your environment. None of this is exotic: it is the standard playbook of credential-first intrusion, executed against an unusually wide victim base that scales across businesses and critical infrastructure sectors.
What distinguishes SafePay procedurally is the discipline of its double extortion. Actors copy data out before encrypting anything, using RClone, WinSCP, FileZilla and Backblaze’s b2.exe, then lock files and rename them with the .SafePay extension. Non-payers’ data is posted to the group’s leak site, and victims are driven to a chat portal on a TOR address to negotiate. Brandefense’s analysis of the advisory also notes that actors sometimes deleted all network-attached backups, which elevates backup hygiene from a checklist item to the difference between a ransom decision and a restore decision.
The Five Flaws and What to Patch
All five exploited vulnerabilities are already in the CISA Known Exploited Vulnerabilities catalog, flagged for known ransomware use. The advisory names the CVEs; vendor advisories supply the products and fixes.
- – CVE-2020-3259, Cisco ASA and FTD: an unauthenticated attacker can read device memory with a crafted request on certain AnyConnect and WebVPN configurations. Fixed in ASA 9.8.4.20 and later listed branches; Cisco lists no workaround, so upgrade is the only door-close.
- – CVE-2023-20269, Cisco ASA and FTD remote access VPN: brute-force of valid usernames and passwords, not an authentication bypass. MFA on every VPN account and limiting failed logins materially blunts it.
- – CVE-2023-27532, Veeam Backup and Replication: an unauthenticated network user can pull encrypted credentials from the configuration database. Fixed in 12.0.0.1420 (P20230223) and 11.0.1.1261 (P20230227); blocking inbound TCP 9401 buys time until patching.
- – CVE-2024-40711, Veeam Backup and Replication: unauthenticated remote code execution with a 9.8 CVSS on 12.1.2.172 and earlier 12.x builds. Fixed in build 12.2.0.334, and the backup server should not face the internet regardless.
- – CVE-2024-40766, SonicWall SonicOS: improper access control in management access, affecting Gen 5, 6 and early Gen 7 firmware. Patch per advisory SNWLID-2024-0015 and keep firewall management off the open internet.
The advisory adds that actors exploited the Veeam and SonicWall flaws on internet-exposed systems using automated scripts, and used the Cisco edge flaws after landing through phished account profiles. Translation for patch teams: the internet-facing perimeter and the backup server are the two crown boxes, in that order.
Why the Timing Matters for US Organizations
SafePay is not a new name in incident response circles, but a six-agency advisory is a different signal than a vendor profile. Joint US-Ukin… US-UK-German advisories generally follow a period in which the group’s tradecraft stabilized and its victim count made it a named priority, which is where SafePay has been through 2026: among the most active ransomware operations of the year. Companies running Cisco edge gear, Veeam backups or SonicWall firewalls should treat the advisory as a work order dated October 20, not as background reading, because the catalog status of the five CVEs gives federal contractors a hard patching deadline on November 3, 2026, two weeks from the advisory date.
The Controls That Beat the Group
Patching closes five doors, but the advisory’s core defense list is older than SafePay and more durable than any single CVE. Require MFA, especially for webmail, VPNs and accounts on critical systems. Use long passwords, 15 to 64 characters, with no reuse and lockouts after failed attempts. Keep encrypted, immutable, offline backups and test the restore, because the group deletes backups before encrypting. Segment networks and run EDR to catch lateral movement. Audit domain controllers, servers and Active Directory for accounts nobody recognizes, and alert when security tooling is stopped or modified, since the advisory even lists tool-disabling (T1685) as a named behavior to watch for.
For a small IT team, the week’s realistic priority list: inventory which of the five products you run and at what versions, apply the fixes above, force MFA on every VPN account, and verify one backup copy is unreachable from the domain. If any of the named flaws was open on an internet-facing system before the patch, treat that system as a possible intrusion and review its accounts, logs and scheduled tasks before assuming you were not touched.
What Happens Next
Expect the SafePay saga to ripple three ways. Federal contractors face the November 3 patching deadline for the cataloged CVEs, and the advisory gives auditors a ready-made checklist. Fortune 500 boards will ask their CISOs the uncomfortable version of this week’s question, which is not what does SafePay exploit but whether our backup server is internet-reachable, a question the answer should have been no for years. And expect copycat crews to fold the same five CVEs into their own exploit chains, a pattern seen after every major joint advisory, which is why the patching urgency extends to any organization still unpatched on Cisco ASA, Veeam or SonicWall products even if it has never heard of SafePay. The group’s 600-victim run through this quarter shows the door was often left open; this advisory finally prints the address of the door.
Frequently Asked Questions
What is SafePay ransomware?
SafePay is a ransomware group active since August 2024 that steals or guesses passwords, copies data with cloud tools, encrypts files with the .SafePay extension and posts non-payers’ data to a leak site. It has hit at least 600 victims.
Which vulnerabilities does SafePay exploit?
The advisory names two Cisco ASA/FTD flaws (CVE-2020-3259, CVE-2023-20269), two Veeam Backup and Replication flaws (CVE-2023-27532, CVE-2024-40711) and one SonicWall SonicOS flaw (CVE-2024-40766), all in CISA’s known-exploited catalog.
What should my organization do first?
Patch the five flaws, enforce MFA on VPNs and webmail, verify an immutable offline backup exists, and audit Active Directory for unrecognized accounts; treat any previously internet-exposed vulnerable system as possibly compromised.
Sources:
