CISA Joint Alert: SafePay Ransomware Targets Backups, Hits 600+ Firms
A multi-agency advisory warns that SafePay actors have breached hundreds of organizations, destroying backups to block recovery efforts.
Key points
- CISA and partners report SafePay ransomware compromised at least 600 organizations since August 2024.
- Attackers deliberately destroy backup systems to obstruct recovery after encrypting data and stealing files.
- The campaign exploits five specific vulnerabilities, including a critical deserialization flaw with a 9.8 CVSS score.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a joint advisory on October 20, 2026, warning that SafePay ransomware operators have compromised at least 600 organizations. This alert was published in coordination with the FBI, the U.S. Secret Service, and law enforcement agencies from Germany and the United Kingdom. The agencies combined their investigative findings, which were collected through August 2026, to detail the scope and methods of this ongoing campaign.
The advisory states that SafePay actors have targeted victims across North America, South America, Europe, and Australia since August 2024. These groups operate within multiple critical infrastructure sectors. Their primary tactic involves combining data theft with file encryption. Crucially, they deliberately attack and destroy backup systems. This destruction of backups is designed to obstruct recovery efforts, as stated in the joint advisory.
Technical Tactics and Vulnerabilities
Investigators observed that SafePay operators rely heavily on exploiting known software weaknesses. The advisory identifies five specific vulnerabilities used for initial access: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. These flaws cover issues such as information exposure, authentication failures, unsafe deserialization, and improper access controls. Among these, CVE-2024-40711 is rated as critical with a CVSS score of 9.8, allowing unauthenticated remote code execution through the deserialization of untrusted data.
Another exploited weakness, CVE-2024-40766, affects SonicWall SonicOS management access. This flaw can potentially allow unauthorized resource access and, under specific conditions, cause firewall crashes. Attackers also gain entry through exposed credentials, phishing campaigns, brute-force attacks, and internet-accessible vulnerable systems. They frequently use Mullvad VPN addresses to mask their connections and abuse compromised account profiles alongside automated exploitation scripts to scale their operations.
Persistence and Lateral Movement
Once inside a network, SafePay operators establish persistence by creating new accounts or hijacking existing administrative privileges. They rely on legitimate administration utilities to blend malicious activity into routine enterprise operations. Tools such as PsExec, Windows Remote Management, and Remote Desktop Protocol support command execution and lateral movement across the network. To identify valuable information before exfiltration and encryption, operators use ShareFinder.ps1 and SharpShares.exe to enumerate network shares.
The group escalates privileges using User Account Control bypass and token impersonation techniques. They often turn off security software and change user passwords to prevent legitimate access. To conceal their malicious code, they employ software packing and virtual machine protection. Remote access applications, including AnyDesk and TeamViewer, help deliver ransomware and supporting tools. For data theft, attackers use WinSCP and RClone, with OneDrive observed in some intrusions as an exfiltration channel.
What should you do?
Organizations should verify if they are running SonicOS devices or other software linked to the listed CVEs. Administrators must check for unpatched systems exposing the identified vulnerabilities to the internet. Security teams should monitor for unusual use of legitimate admin tools like PsExec and remote access applications such as AnyDesk. Ensuring backups are offline and immutable can mitigate the impact of backup destruction attempts.
What to do and how to stay safe: CISA
- Audit internet-facing systems for the five specific CVEs listed in the advisory, prioritizing the critical CVE-2024-40711.
- Monitor logs for abnormal usage of remote management tools, including PsExec, RDP, and third-party remote access apps.
- Verify that backup systems are isolated and immutable to prevent ransomware actors from deleting or encrypting them.
- Review authentication logs for signs of credential stuffing, brute-force attacks, or the creation of new administrative accounts.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which agencies published the SafePay ransomware advisory?
CISA published the advisory jointly with the FBI, the U.S. Secret Service, and German and British law enforcement partners.
How many organizations have been compromised by SafePay?
CISA reports that SafePay ransomware actors have compromised at least 600 organizations across multiple sectors.
What specific vulnerabilities are exploited by SafePay operators?
The advisory lists CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 as exploited weaknesses.
