#StopRansomware: SafePay Ransomware Advisory Issued by International Agencies

A joint cybersecurity advisory designated AA26-293A, published on October 20, 2026, by the FBI, CISA, the United States Secret Service (USSS), Germany's Landeskriminalamt Rheinland-Pfalz, the United Kingdom's National Crime Agency, and the UK's North West Regional Organised Crime Unit, warns of ongoing activity by the SafePay ransomware group.

According to the advisory, SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. Initial access is typically gained through credential exposure, brute force password attacks (T1110), exploitation of virtual private network (VPN) appliances, and phishing campaigns. Once inside the network, SafePay actors establish persistence by creating new accounts or hijacking existing ones, then use legitimate system tools to move laterally, identify valuable files, and disable security protections to avoid detection.

The ransomware encryption process renders victim files inaccessible, after which a ransom note demanding payment in cryptocurrency is left on the system. The advisory notes that since August 2024, SafePay ransomware has affected at least 600 separate victims across multiple critical infrastructure sectors.

The advisory lists several CVEs that have been exploited by SafePay actors to gain initial access, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. The authoring agencies urge organizations to patch these vulnerabilities, implement Zero Trust principles, restrict administrative privileges, and strengthen account security through identity and credential management (ICAM) policies and multifactor authentication (MFA).

For network defenders, the advisory provides indicators of compromise (IOCs) in downloadable STIX XML and STIX JSON formats, as well as a detailed mapping of observed TTPs to the MITRE ATT&CK for Enterprise framework version 20.