Key points
- SafePay has affected at least 600 organisations across multiple critical infrastructure sectors since August 2024.
- Attackers deliberately destroy backup systems and shadow copies to prevent victims from restoring data without paying.
- The group exploits five known vulnerabilities, including a critical flaw in Veeam Backup & Replication software.
Organisations in North America, South America, Europe, and Australia are facing severe disruption from SafePay ransomware, which has compromised at least 600 entities since August 2024. These victims span multiple critical infrastructure sectors, with their operational data and recovery systems directly targeted by the threat actors.
A joint advisory issued on 20 October 2026 by CISA, the FBI, the US Secret Service, and European law enforcement partners outlines the group’s persistent campaign. The agencies note that SafePay is one of the most active ransomware groups in 2026, combining file encryption with data theft to pressure victims into paying ransoms.
Tactics and Vulnerabilities Exploited
SafePay operators gain initial access through exposed credentials, brute-force attacks, phishing, and vulnerable internet-facing systems. According to CISA, they frequently use Mullvad VPN addresses to mask their connections. Once inside, they abuse legitimate administration tools like PsExec and Windows Remote Management to move laterally across networks and identify valuable data for exfiltration.
The group exploits five specific vulnerabilities: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. CVE-2024-40711, which affects Veeam Backup & Replication, allows unauthenticated remote code execution and carries a critical CVSS score of 9.8. CVE-2024-40766 impacts SonicWall SonicOS management access, potentially allowing unauthorized resource access.
Impact on Backup and Recovery
Attackers deliberately target backup infrastructure to obstruct recovery. Investigators documented SafePay operators deleting shadow copies and resetting network-attached storage devices containing backups. This tactic ensures that victims cannot simply restore files from local copies, forcing them to consider ransom payment. The group also disables security software and changes user passwords to maintain persistence and block legitimate access.
Our take on the response
The joint advisory emphasises that paying ransoms does not guarantee the recovery of encrypted files. Agencies urge victims to report incidents to law enforcement rather than engaging with the criminals. The focus of the response is on defensive measures, including restricting administrative privileges, implementing multifactor authentication, and keeping edge devices updated to block initial access via known vulnerabilities.
What affected people can do
Teams should verify the integrity of offsite backups immediately, ensuring they are isolated from the main network. Check for unexpected administrative accounts or changes to user passwords, which often indicate compromise. Monitor logs for unusual activity from legitimate administration tools like PsExec or RDP. Be wary of follow-up communications claiming to be from vendors or support, as criminals may attempt to harvest further credentials. Report any signs of intrusion to local law enforcement authorities without delay.
Background: Threat actors
Threat actors in cybersecurity are individuals or groups who intentionally compromise systems to steal data, disrupt operations or extort money. They range from lone hackers to state-sponsored teams. Defending against them requires analysing behaviour, not just blocking known malicious files or IP addresses.
Read the full guide: Threat Actors in Cybersecurity: Tactics, Profiles and Detection Strategies
What to do and how to stay safe: SafePay
- Restrict administrative privileges and disable unnecessary remote management tools to limit lateral movement.
- Implement multifactor authentication for all user accounts, particularly those with remote access capabilities.
- Keep systems updated, focusing on patches for VPNs, firewalls, and backup software like Veeam and SonicWall.
- Monitor for automated exploitation scripts and unusual connections from VPN services used in known attacks.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific vulnerabilities are SafePay exploiting?
The group exploits CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
Does Mullvad VPN have a security flaw?
No, investigators noted SafePay used Mullvad addresses to hide their location; the service itself was not compromised.
How many organisations have been affected?
At least 600 organisations across multiple critical infrastructure sectors have been compromised since August 2024.