SafePay Ransomware Attacks 600+ Orgs via VPN, Backup Server Exploits

Key Takeaways

• The SafePay ransomware group has compromised over 600 organizations globally since August 2024, targeting critical infrastructure.
• Initial access frequently occurs through exploited VPNs, backup servers, and compromised credentials, leveraging multiple known vulnerabilities including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
• SafePay employs a multi-stage attack, escalating privileges, exfiltrating data, and crippling recovery systems before encrypting files with ChaCha20 and RSA.
• International cybersecurity agencies strongly advise against paying ransoms and recommend immediate patching, robust authentication, and isolated backup strategies.

A recent government advisory, issued on October 20, 2026, reveals that the SafePay ransomware collective has impacted more than 600 organizations across various critical infrastructure sectors. This group, active since August 2024, has emerged as a significant ransomware threat throughout 2026, with victims spanning North America, South America, Europe, and Australia.

The attacks are characterized by a sophisticated blend of tactics, including the use of stolen credentials, exploitation of exposed remote access services, and known software vulnerabilities. Upon gaining initial network access, SafePay operators systematically compromise accounts, identify and exfiltrate sensitive data, and sabotage recovery infrastructure before encrypting victim files. This dual threat of operational disruption and data exposure places immense pressure on targeted entities.

The joint SafePay ransomware advisory, which details these activities, compiles findings from investigations conducted up to August 2026. Analysts at CISA and partner agencies noted the collaborative effort involved the FBI, United States Secret Service, German investigators, and UK law enforcement. Their collective intelligence highlights SafePay’s heavy reliance on legitimate administrative tools and compromised trusted accounts for its malicious operations.

SafePay Ransomware’s Broad Impact

SafePay operators initiate intrusions primarily through exposed credentials, brute-force password attempts, phishing campaigns, and by exploiting vulnerable internet-facing systems. Prior reports on SafePay attacks also documented the group’s use of compromised RDP and VPN connections. The latest advisory further elaborates on their methods, including automated exploitation and the abuse of phished account profiles to penetrate victim networks.

Agencies have identified specific vulnerabilities leveraged by SafePay, including CVE-2020-3259 and CVE-2023-20269 in edge devices. Additionally, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 have been exploited across various internet-exposed systems. Investigators also observed attackers utilizing Mullvad VPN addresses during intrusions, indicating the service was used to obscure their activity rather than implying a compromise of Mullvad itself or its general user base.

Backup infrastructure represents another critical target for SafePay. Specifically, CVE-2024-40711, a vulnerability in Veeam Backup & Replication, permits unauthenticated remote code execution. Previous ransomware incidents, involving other families, have demonstrated how attackers combine compromised VPN access with this flaw to establish unauthorized administrator accounts, underscoring a shared vulnerability in backup solutions.

Leveraging Trusted Tools for Lateral Movement

Once inside a network, SafePay operators escalate privileges or create new accounts. They deploy standard IT tools such as PsExec, Windows Remote Management, and Remote Desktop Protocol to execute commands and traverse the network. Since these tools are commonly used for legitimate administrative tasks, organizations must meticulously examine their usage patterns, including who initiated them, where they were executed, and if their activity aligns with approved operational procedures.

Attackers systematically search shared folders for valuable data, disable security software, and frequently change user passwords to lock out legitimate personnel. Investigators have also documented methods used to bypass Windows User Account Control and reuse security tokens for elevated access. The use of code packing helps conceal malicious programs, while remote support applications serve as another vector for deploying malware onto compromised systems.

For data exfiltration, SafePay leverages widely available tools such as 7-Zip, WinRAR, RClone, WinSCP, and FileZilla. Some incidents have involved the use of cloud storage services like OneDrive or Backblaze. While these applications are benign by nature, their unexpected deployment, unusual data transfers, and connections to external, unauthorized accounts, especially when combined with other indicators of compromise, should trigger immediate investigation.

The group’s relentless focus on disrupting recovery capabilities makes its attacks particularly destructive. Operators are known to halt the Volume Shadow Copy Service and have reset network-attached storage units containing backups to their factory defaults. This highlights the critical importance of securing remote access points before attackers can penetrate internal networks and compromise essential backup resources, as demonstrated in related reports on SonicWall access control vulnerabilities.

After data theft, SafePay encrypts files using a combination of ChaCha20 and RSA algorithms. The ransomware can encrypt entire files or specific portions, depending on file type and size. Victims are typically presented with a ransom note directing them to a Tor chat portal, often accompanied by phone calls and threats to publish stolen data to coerce payment. The malware may self-delete following its execution.

What You Should Do

• Immediately apply all available patches to internet-facing systems, especially VPNs, backup servers, and network edge devices, addressing vulnerabilities like CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
• Implement and enforce multifactor authentication (MFA) across all services, particularly for remote access, administrative accounts, and critical systems.
• Restrict administrator rights to only essential personnel and roles, adhering to the principle of least privilege.
• Ensure backup copies are isolated offline or protected against unauthorized modification and deletion. Regularly test backup restoration procedures.
• Segment networks to limit lateral movement, preventing attackers from easily reaching sensitive files and recovery data even if initial access is gained.
• Actively monitor for unusual account activity, unexpected remote tool usage, disabled security protections, and abnormal outbound data transfers. Correlate these events for a comprehensive view of potential compromise.
• In case of suspected intrusion, immediately isolate affected systems, preserve all logs for forensic analysis, and thoroughly investigate the scope of the breach.
• Do not pay the ransom. Ransom payments do not guarantee data recovery and may fund further criminal activities.

Indicators of Compromise (IoCs):-

IP Addresses

Source: CISA advisory, Table 2.