SafePay Ransomware Has Hit at Least 600 Victims, FBI, CISA and UK Police Warn

The ransomware gang that law enforcement agencies on both sides of the Atlantic are warning about this week rarely needs a new trick to get in. SafePay walks through stolen passwords and through security flaws in VPN gateways and backup servers that were patched long ago and that the US government listed as exploited two to three years ago.

That is the picture in a joint advisory published on 20 October by the FBI, the US Cybersecurity and Infrastructure Security Agency (CISA), the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency and the North West Regional Organised Crime Unit. The agencies say SafePay has been “highly active since August 2024”, has “impacted at least 600 separate victims from multiple critical infrastructure sectors”, and “was among the most active ransomware groups in 2026.”

The advisory is the latest entry in TSN’s Ransomware & Cyber Attacks hub.

British police helped write the warning

Two UK bodies co-signing a #StopRansomware advisory gives it direct weight for British organisations. The details come from FBI, Secret Service and Rheinland-Pfalz investigations running “as recently as August 2026”, and the indicators of compromise were observed between November 2024 and August 2026. SafePay’s victims are spread across North America, South America, Europe and Australia.

The advisory gives UK victims their own reporting route: Report Fraud on 0300 123 2040, a local police force, or the non-emergency 101 number. It also points readers to the National Cyber Security Centre and the NCA. Like the US agencies, the UK co-authors discourage paying, because payment carries no guarantee that files come back and may encourage further attacks.

Five old bugs do much of the work

SafePay’s operators get their first foothold by exposing or guessing credentials, using brute force and abusing VPN access, according to the advisory. Connecting through IP addresses belonging to the VPN provider Mullvad, they use phished account profiles to exploit two flaws in edge devices, and run automated scripts against three more on internet-facing systems.

The advisory lists only the CVE numbers. The US National Vulnerability Database ties each one to a product, and every one is already in CISA’s catalogue of known exploited vulnerabilities:

The Veeam bug CVE-2023-27532 has turned up before. Palo Alto’s Unit 42 said this week that ransomware crews exploiting a GlobalProtect flaw had also chained their access with it, as TSN reported.

Backups are wiped before files are locked

Once inside, the operators give themselves administrator rights, on existing accounts or new ones, and move around with tools already built into Windows, such as PsExec and Windows Remote Management. They hunt for valuable file shares with the PowerShell script ShareFinder.ps1, switch off security software and sometimes change users’ passwords so that nobody can log in.

Recovery is the next target. The group stops the Volume Shadow Copy Service and resets network-attached storage holding backups “to initial factory settings”, the agencies say. Only after data has been copied out, using tools such as WinSCP, RClone and sometimes OneDrive, are files encrypted with a mix of the ChaCha20 cipher and RSA. The ransom note points to a Tor chat portal, and SafePay “typically demand[s] a subset of company revenue in cryptocurrency”. A representative also phones victims to add pressure, and unpaid victims’ data goes on a leak site.

The security firm Huntress, which first spotted SafePay in its own customers’ systems in October 2024, describes it as a closed operation rather than ransomware-as-a-service: the same core team handles access, deployment and extortion. Huntress found heavy overlap between SafePay’s code and leaked LockBit Black source code, and counts more than 270 victims claimed in 2025 alone.

The fix list starts with edge devices

The agencies’ first recommendation is to patch firewalls and other edge devices, prioritising known exploited vulnerabilities on internet-facing systems. They also call for multifactor authentication on webmail, VPNs and accounts with access to critical systems; limits on who can use administrative tools; offline, encrypted and immutable backups that are tested regularly; and network segmentation to slow lateral movement. Indicators of compromise, including IP addresses, file names and hashes, are available in STIX format alongside the advisory.

For defenders, the uncomfortable point is that none of SafePay’s listed entry points is new. Each has a patch and a place on CISA’s exploited list, and the youngest was added two years ago this month. An organisation that has kept its VPN gateways and backup servers current has closed the doors the advisory names, though stolen and guessed passwords remain a route that only multifactor authentication and monitoring can block.

The advisory gives no breakdown by country, so how many of SafePay’s 600 victims are in the UK is still an open question.

Related stories

• Ransomware Gangs Exploit Months-Old Palo Alto GlobalProtect Flaw, Unit 42 Says

Sources

• CISA, FBI, USSS, LKA Rheinland-Pfalz, NCA and North West ROCU: #StopRansomware: SafePay Ransomware (AA26-293A), 20 October 2026
• NVD: CVE-2020-3259
• NVD: CVE-2023-20269
• NVD: CVE-2023-27532
• NVD: CVE-2024-40711
• NVD: CVE-2024-40766
• Huntress: SafePay Ransomware: How It Works & How to Stop It
• TSN: Ransomware Gangs Exploit Months-Old Palo Alto GlobalProtect Flaw, Unit 42 Says