#StopRansomware SafePay (AA26-293A): FBI, CISA, US Secret Service and German and UK police say the group has hit at least 600 organisations since August 2024, including in Australia, getting in through stolen or guessed VPN passwords and old Cisco ASA, Veeam and SonicWall flaws
The FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit published joint advisory AA26-293A on 20 October 2026 on the SafePay ransomware group. They say SafePay has been highly active since August 2024 and was among the most active ransomware groups of 2026, hitting at least 600 victims in multiple critical infrastructure sectors across North America, South America, Europe and Australia. The tactics and indicators come from FBI, Secret Service and German investigations as recently as August 2026. SafePay gets in with exposed or brute-forced credentials and VPN access, often from Mullvad VPN addresses, using phished accounts against Cisco ASA and Firepower Threat Defense flaws CVE-2020-3259 and CVE-2023-20269, and automated scripts that exploit internet-facing systems through Veeam Backup & Replication CVE-2023-27532 and CVE-2024-40711 and SonicWall SonicOS CVE-2024-40766. Once inside, the actors create accounts or take over existing ones, use living-off-the-land tools (PsExec, WinRM, RDP, remote management software and ScreenConnect), enumerate shares with ShareFinder.ps1 and SharpShares, dump credentials with Mimikatz and DCSync tools, bypass User Account Control, turn off security software and sometimes change users' passwords to lock them out. They compress data with 7-Zip or WinRAR and exfiltrate it with WinSCP, RClone, FileZilla, OneDrive or the Backblaze b2 tool, use AnyDesk or TeamViewer to drop the ransomware, stop Volume Shadow Copy and reset backup NAS devices to factory settings, then encrypt files with ChaCha20 and RSA (extension .SafePay). The ransom note points to a Tor chat portal, a representative phones victims to pressure them, and stolen data is posted on the SafePay leak site if they do not pay. The advisory includes IP addresses, file names, hashes and STIX files for indicators seen between November 2024 and August 2026. Australian angle: the ransomware.live Australia page lists eight SafePay leak-site claims against Australian organisations between December 2025 and July 2026 (claims, not confirmed incidents). Primary: CISA AA26-293A (20 Oct); wire: The Record (20 Oct).
- Product
- SafePay ransomware operations; initial access via Cisco ASA/FTD (CVE-2020-3259, CVE-2023-20269), Veeam Backup & Replication (CVE-2023-27532, CVE-2024-40711) and SonicWall SonicOS (CVE-2024-40766), plus stolen or brute-forced VPN credentials
- Versions
- n/a — threat advisory; patch the listed edge and backup products to vendor-fixed versions
- Exploited in Australia?
- unknown
- Patch to
- Patch Cisco ASA/FTD, Veeam Backup & Replication and SonicWall firewalls against the five listed CVEs and keep every edge device current. Put phishing-resistant MFA on all VPN and remote access, block or alert on VPN logins from commercial VPN ranges such as Mullvad, and lock out brute-force attempts. Restrict PsExec, WinRM, RDP and remote management or remote desktop tools (AnyDesk, TeamViewer, ScreenConnect) to approved admins, and alert on new admin accounts, DCSync and Mimikatz activity, security tools being stopped, RClone, WinSCP or b2.exe transfers and unusual OneDrive uploads. Keep offline, immutable backups and protect backup NAS admin interfaces from factory resets. Load the AA26-293A STIX indicators into your SIEM and EDR. Report incidents to ASD's ACSC (cyber.gov.au, 1300 CYBER1).
Primary: CISA, FBI, USSS, LKA Rheinland-Pfalz, NCA and NWROCU — #StopRansomware: SafePay Ransomware (AA26-293A, 20 Oct 2026; PDF and STIX IoCs) · Vendor: StopRansomware.gov — #StopRansomware advisories · CVE: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766 · The Record — FBI says SafePay ransomware gang 'among most active' with more than 600 victims since 2024 (20 Oct 2026)