CISA, FBI and Partners Issue SafePay Ransomware Advisory: At Least 600 Victims, Stolen Credentials and Edge-Device Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI) and the U.S. Secret Service, together with law enforcement partners in Germany and the United Kingdom, issued joint cybersecurity advisory AA26-293A on October 20, detailing the tactics of the SafePay ransomware group and recommended defenses. According to the advisory, the group has affected at least 600 victims since August 2024, across multiple critical infrastructure sectors in North America, South America, Europe and Australia, and ranks among the most active ransomware operations of 2026.
"SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors," said Brett Leatherman, assistant director of the FBI's cyber division, as the advisory was released.
According to the advisory, SafePay gains initial access mainly through external remote services (VPN) and vulnerabilities in public-facing applications, combined with stolen or guessed credentials, phishing and brute-force attacks. The advisory lists five exploited vulnerabilities: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, affecting firewall, VPN and backup products. Once inside, the actors create or take over accounts, use legitimate system tools to move through the network, locate valuable files and disable security protections, then steal data and encrypt systems, demanding payment in cryptocurrency and threatening to publish the stolen data. In some cases, the group also calls victims directly to apply pressure.
The advisory's indicators of compromise cover an observation window from November 2024 to August 2026 and were published in STIX format alongside the advisory. Co-authors also include Germany's Landeskriminalamt Rheinland-Pfalz, the United Kingdom's National Crime Agency and the UK North West Regional Organised Crime Unit.
The agencies' recommended defenses include promptly patching firewalls and other edge devices, enforcing multifactor authentication, adopting Zero Trust controls, restricting the use of administrative tools, and keeping offline backups.
Published by GSM · USA (original Chinese edition)
Photo: 图：美国网络安全与基础设施安全局（CISA）位于Arlington的总部活动（资料图）。照片：美国国土安全部（DHS），公共领域（维基共享资源）／Photo: A Cybersecurity and Infrastructure Security Agency (CISA) event at its Arlington headquarters (file photo). Photo: U.S. Department of Homeland Security, public domain (Wikimedia Commons)
