Key points
- SafePay ransomware has compromised at least 600 organizations across critical infrastructure sectors since August 2024.
- Attackers exploit five specific vulnerabilities, including CVE-2024-40711 in Veeam Backup & Replication, to destroy recovery systems.
- The group uses Mullvad VPN connections, phished accounts, and automated scripts to gain initial access to networks.
The Cybersecurity and Infrastructure Security Agency issued a joint advisory on October 20, 2026, detailing how SafePay ransomware operators have breached at least 600 organizations. The report, published with the FBI, US Secret Service, and international partners, covers operations from August 2024 through August 2026.
SafePay actors target critical infrastructure in North America, South America, Europe, and Australia. They combine data theft with file encryption and deliberately attack backup systems to obstruct recovery efforts. Investigators found the group uses exposed credentials, brute-force attacks, and phishing to enter networks.
Exploitation Tactics
The advisory identifies five exploited vulnerabilities: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. CVE-2024-40711 allows unauthenticated remote code execution in Veeam Backup & Replication and carries a critical CVSS score of 9.8. CVE-2024-40766 affects SonicWall SonicOS management access, potentially causing firewall crashes.
Attackers use automated exploitation scripts to abuse these flaws on internet-exposed systems. They also connect via Mullvad VPN addresses, though investigators noted this describes the service used during intrusions, not a compromise of Mullvad itself.
Targeted Environments
Once inside, operators establish persistence by creating accounts or obtaining administrative privileges. They rely on legitimate administration utilities like PsExec, Windows Remote Management, and Remote Desktop Protocol for lateral movement. Tools such as ShareFinder.ps1 and SharpShares.exe help them enumerate network shares before exfiltrating data.
SafePay operators disable security software, change user passwords, and use WinSCP or RClone for data theft. They may also reset network-attached storage devices containing backups. The agencies advise restricting administrative tools and implementing multifactor authentication to block lateral movement.
Next steps
Security teams should update systems, focusing on flaws affecting VPNs, firewalls, and edge devices. CISA urges victims to report incidents to law enforcement, noting that paying ransoms does not guarantee file recovery. Defenders must secure identity and credential management policies to protect against phished account profiles.
Signals worth monitoring
Teams usually detect this activity by reviewing logs for unusual administrative tool usage, such as PsExec or RDP connections from unexpected sources. Check whether backup systems show signs of unauthorized access or deletion of shadow copies. Look for new accounts created with high privileges or password changes that block legitimate users. Verify if remote access applications like AnyDesk are running without authorization. Investigate outbound connections to known VPN provider IPs that do not align with normal business traffic patterns.
Background: Ransomware
Ransomware protection combines network segmentation, strict least-privilege access, and immutable backups to prevent encryption malware from spreading. You must detect initial access vectors like phishing or unpatched services, isolate infected systems immediately, and restore data from offline copies that attackers cannot modify or delete.
Read the full guide: What Is Ransomware Protection: How to Stop Encryption Attacks
What to do and how to stay safe: SafePay
- Audit internet-facing systems for the five cited CVEs and apply patches once vendors provide updates.
- Review administrative account activity for unexplained privilege escalations or new account creations.
- Verify the integrity of backup systems and ensure they are isolated from primary network traffic.
- Monitor for the use of legitimate admin tools like PsExec in unexpected contexts or times.
Step-by-step guide: Immutable Backups: Best Practices for Ransomware Resilience
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which vulnerabilities does SafePay exploit?
The group exploits CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
Does SafePay compromise Mullvad VPN?
No, investigators stated that SafePay operators connect through Mullvad addresses, but the service itself was not compromised.
How many organizations have been affected?
CISA reports that SafePay has compromised at least 600 organizations across multiple critical infrastructure sectors.
