CISA has warned that SafePay ransomware actors have compromised at least 600 organizations across multiple critical infrastructure sectors, combining data theft and encryption with deliberate attacks on backup systems to obstruct recovery.
The October 20, 2026, joint advisory describes operations spanning North America, South America, Europe, and Australia since August 2024.
Published with the FBI, United States Secret Service, and German and British law enforcement partners, it incorporates investigative findings collected through August 2026.
Investigators observed connections originating from Mullvad VPN addresses, alongside abuse of compromised account profiles and automated exploitation scripts.
The advisory identifies five exploited vulnerabilities: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
These weaknesses span information exposure, authentication failures, unsafe deserialization, and improper access controls.
CVE-2024-40711 enables unauthenticated remote code execution through deserialization of untrusted data and carries a critical CVSS score of 9.8.
CVE-2024-40766 affects SonicWall SonicOS management access, potentially allowing unauthorized resource access and, under specific conditions, firewall crashes.
Once inside, attackers establish persistence by creating accounts or obtaining administrative privileges through existing accounts.
Their reliance on legitimate administration utilities allows malicious activity to blend into routine enterprise operations.
PsExec, Windows Remote Management, and Remote Desktop Protocol support command execution and lateral movement.
ShareFinder.ps1 and SharpShares.exe enumerate network shares, helping operators identify valuable information before exfiltration and encryption.
According to CISA, SafePay operators gain entry through exposed credentials, phishing, brute-force attacks, and internet-accessible vulnerable systems.
SafePay Ransomware Attack
Investigators also documented User Account Control bypass and token impersonation for privilege escalation.
SafePay operators turn off security software and sometimes change user passwords, preventing legitimate access.
Software packing and virtual machine protection further conceal malicious code, while remote access applications, including AnyDesk and TeamViewer, help deliver ransomware and supporting tools.
For data theft, attackers use WinSCP and RClone, with OneDrive observed in some intrusions.
Archives created with utilities such as 7-Zip and WinRAR support staging, while the advisory also documents exfiltration to Backblaze B2 using b2.exe.
The recovery sabotage is particularly consequential: operators stop the Volume Shadow Copy Service and reset network attached storage containing backups to factory settings.
Investigators reported cases where all network attached company backups were deleted, undermining restoration options before ransom negotiations.
After exfiltration, SafePay encrypts files using ChaCha20 and RSA, applying full or partial encryption according to file characteristics.
Affected files receive the .SafePay extension, and ransom notes direct victims to a Tor chat portal using a victim identifier.
Demands typically reflect a portion of company revenue and require cryptocurrency payment.
Representatives also telephone victims to intensify pressure, while stolen information may be published on the group’s leak site if payment is withheld.
CISA urges organizations to prioritize exploited vulnerabilities on exposed systems, enforce multifactor authentication, restrict administrative privileges, and segment networks.
Offline, encrypted, immutable backups and regularly tested restoration procedures are central to limiting operational disruption.
Defenders should investigate unexpected accounts, remote administration activity, security service changes, and unusual outbound transfers.
The advisory provides downloadable STIX intelligence and cautions that legitimate tools or historical IP addresses require contextual verification before blocking.
Organizations detecting an intrusion should isolate affected hosts, preserve investigative evidence, scope compromised accounts, and coordinate eviction.
IOCs
| IP Address | Description |
|---|---|
| 104.26.2[.]223 | SafePay victim intrusion |
| 140.82.114[.]4 | SafePay victim intrusion |
| 185.199.108[.]133 | SafePay victim intrusion |
| 77.37.49[.]40 | SafePay victim intrusion |
| 173.194.194[.]94 | Hosting victim data |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
