Fala com um especialista
PreçosNotíciasFala com um especialista
Voltar à sala de imprensa
Ameaças

SafePay Ransomware Hits 600+ Organizations Through VPNs and Backup Servers

A joint CISA/FBI advisory says SafePay has hit at least 600 organizations by exploiting VPN and edge-device flaws and weak credentials, then wiping backups before encrypting. Here's how it works and what to fix first.

4T4Tify Team4Tify
Oct 21, 2026·5 min de leitura
SafePay Ransomware Hits 600+ Organizations Through VPNs and Backup Servers

SafePay ransomware: 600+ victims, and the door is usually the VPN

A new joint government advisory puts SafePay among the busiest ransomware operations of 2026, with at least 600 victim organizations across critical-infrastructure sectors in North America, South America, Europe and Australia. The group has been active since August 2024. Its playbook is not exotic. It relies on weak or stolen remote-access credentials and on unpatched edge and backup systems, and once inside it goes after your ability to recover.

What happened

US agencies, led by CISA and the FBI and supported by the US Secret Service and German and UK law enforcement, published a joint advisory on October 20, 2026. It describes SafePay's tradecraft based on investigations running through August 2026.

Initial access comes from several directions:

  • Exposed or reused credentials, password-guessing and phishing, including abuse of phished account profiles.
  • Automated exploitation of internet-facing systems. The advisory calls out:
    • CVE-2020-3259 and CVE-2023-20269 in Cisco ASA / Firepower Threat Defense remote-access VPN.
    • CVE-2024-40766 in SonicWall SonicOS access control.
    • CVE-2023-27532 and CVE-2024-40711 in Veeam Backup & Replication. The latter allows unauthenticated remote code execution.
  • Intrusions observed from Mullvad VPN exit addresses. That says nothing about the VPN provider itself. It only means attackers used it to mask their origin.

After the break-in, operators create new accounts or elevate existing ones. They move laterally with PsExec, WinRM and RDP and bypass User Account Control. They disable security tools and sometimes reset user passwords to lock staff out. Data is staged with everyday utilities such as 7-Zip, WinRAR, RClone, WinSCP and FileZilla, then pushed to cloud storage such as OneDrive or Backblaze.

Then they go after recovery. SafePay stops the Volume Shadow Copy Service and has been seen factory-resetting NAS devices that held backups. Only then does it encrypt, using ChaCha20 with RSA and switching between full and partial encryption depending on the file. The ransom note points to a Tor chat portal. Phone calls and threats to leak stolen data add pressure, and the binary may delete itself afterwards.

Why it matters

Almost every step uses either a known, patchable flaw or a legitimate admin tool. That cuts both ways:

  • Prevention is achievable. Most of these CVEs have had fixes available for a year or more.
  • Detection is harder. PsExec, RClone and WinSCP look like normal IT work. Each event looks harmless on its own, and you only see the attack when you put them together.

Targeting Veeam and NAS backups is the worst part. Without clean, offline backups, a victim has little leverage left.

What to do

  1. Patch the edge and the backup tier first. Check Cisco ASA/FTD, SonicWall and Veeam Backup & Replication against the CVEs above, and treat any exposed management interface as urgent.
  2. Enforce MFA on all remote access (VPN, RDP gateways, admin portals) and remove shared or dormant accounts.
  3. Limit administrator rights and watch for new privileged accounts, UAC bypasses, and security tools being switched off.
  4. Make backups untouchable. Keep offline or immutable copies, isolate backup servers and NAS on a separate network segment, and test restores regularly.
  5. Correlate, don't just alert. Unfamiliar accounts, unexpected remote tools, disabled protections and unusual outbound transfers together point to a single intrusion.
  6. Hunt with the published IoCs. The advisory lists IP addresses, SHA-1/SHA-256 hashes and filenames (e.g. locker.dll, soc.dll, sharefinder.ps1). Run them against your EDR and firewall logs.
  7. If you suspect an intrusion, isolate affected machines, preserve logs and scope the incident. The agencies advise against paying, because payment does not guarantee recovery and it funds the next attack.

SafePay's entry points are things an outsider can see: an unpatched VPN appliance or a Veeam server reachable from the internet. Regular vulnerability scanning of your external perimeter is how our team finds these exposures before a ransomware crew's automated tooling does.

Originally reported by Cyber Security News; primary source: the joint CISA / FBI SafePay ransomware advisory (October 20, 2026). This article is 4tify's own summary and analysis.

PARTILHAR