SafePay ransomware: the 5 doors the FBI and CISA alert says to close
On October 20, the FBI, CISA (the U.S. cybersecurity agency), the Secret Service and German and British police agencies released a joint alert on SafePay ransomware. Active since August 2024, the group has hit at least 600 victims in North America, South America, Europe and Australia, and is among the most active groups of 2026.
The good news, if you can call it that: SafePay uses nothing mysterious. It gets in through stolen or guessed passwords, poorly protected VPNs and flaws known for years. Once inside, it uses legitimate tools you may already have. Here are the doors it targets, how the attack unfolds and what stops it at each step.
Your score against SafePay ransomware
Count one point per “yes”. At 5 out of 5, you’ve closed the entry doors described in the advisory. Every “no” is a priority.
The five vulnerabilities named in the advisory
Authorities observed SafePay exploiting these five vulnerabilities. They date from 2020 to 2024: fixes have existed for a long time. If you own one of these products, check today that it is up to date.
| Vulnerability named in the advisory | Product | What you need to know |
|---|---|---|
| CVE-2020-3259 | Cisco ASA / FTD firewall (web services) | Sensitive information exposure. Fix available since 2020. |
| CVE-2023-20269 | Cisco ASA / FTD (remote access VPN) | Authentication bypass. Used with phished account profiles. |
| CVE-2023-27532 | Veeam Backup & Replication | Critical function without authentication: direct access to the backup server. |
| CVE-2024-40711 | Veeam Backup & Replication | Deserialization of untrusted data: code execution on the backup server. |
| CVE-2024-40766 | SonicWall firewall (SonicOS) | Improper access control. Exploited by automated scripts. |
Note the two Veeam vulnerabilities: by targeting the backup server, SafePay ransomware operators go straight for what would let you recover without paying.
How a SafePay attack unfolds, and what stops it
🚩 Signs to watch for
- VPN logins from commercial VPN service addresses (the advisory names Mullvad).
- Repeated login failures on the same account.
✅ What blocks the step
- Two-factor authentication wherever possible.
- Lockout after several failures, fixes on exposed devices.
🚩 Signs to watch for
- A new admin account nobody recognizes.
- Antivirus or a security tool disabled, employee passwords changed.
✅ What blocks the step
- Regular account reviews, especially administrators.
- Immediate alert when a protection is turned off.
🚩 Signs to watch for
- Remote Desktop (RDP) between workstations, PsExec or WinRM used out of habit.
- AnyDesk or TeamViewer appearing on a server.
✅ What blocks the step
- Admin access limited in time and reserved for a few people.
- A list of approved remote control tools.
🚩 Signs to watch for
- Large compressed files (WinRAR, 7-Zip) that appear then vanish.
- Massive outbound transfers, including to a OneDrive that isn’t yours.
✅ What blocks the step
- Alerts on unusual outbound transfers.
- Blocking external OneDrive and Microsoft 365 accounts on your servers.
🚩 Signs to watch for
- Windows Volume Shadow Copy service stopped.
- Network storage device (NAS) reset to factory settings.
✅ What blocks the step
- At least one offline or immutable copy that the attacker can neither change nor erase.
- Restores tested regularly.
🚩 Signs to watch for
- Files renamed to .SafePay, ransom note on the desktop.
- Phone calls on behalf of the group, threats to publish the data.
✅ What blocks the step
- A written response plan: who to call, in what order.
- Don’t negotiate alone: IT provider, insurer, police.
📋 A real case documented by Sygnia
In 2025, the firm Sygnia investigated a SafePay attack. The way in: a FortiGate firewall’s VPN, through a flaw and a misconfigured “local” admin account with a weak password, no two-factor authentication, and permission to connect to the VPN. Within hours, the attackers were domain administrators. For seven days, they moved data out through their own OneDrive, traffic that looked like normal Microsoft 365 syncing. More than 60 servers were then encrypted, mainly backup, virtualization, file and identity servers.
📞 If someone calls you “on behalf of SafePay”
The advisory notes that a representative of the group phones victims to push them to pay. Promise nothing on the phone, write down the time and number, and call your IT provider and your insurer. Also report the incident to the police and to the Canadian Centre for Cyber Security. According to the advisory, files encrypted by SafePay cannot be recovered without the key: only an intact backup leaves you a choice.
This scenario resembles what we described for the GlobalProtect vulnerability and the SonicWall SMA1000 vulnerability: the device guarding the network entrance becomes the door. And as with the IDCF Cloud ransomware, backups out of reach make the difference. For hijacked remote control tools, our “if… then…” decision tree still applies.
At NeoTech, our business network support covers firewall and VPN updates, and our backup and disaster recovery solutions include an offline copy and restore tests. With our cyber monitoring, automated 24/7 monitoring with on-call technician response flags new admin accounts, disabled protections and unusual transfers.
Book your free cyber check
Is your score below 5 out of 5, or can’t you answer some of the questions? The free cyber check reviews exactly your remote access, admin accounts and backups, then hands you a clear plan, in order of priority.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- CISA, FBI, USSS and partners: #StopRansomware: SafePay Ransomware, advisory AA26-293A (October 20, 2026)
- CISA: CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors (October 21, 2026 press release)
- Picus Security: CISA AA26-293A: How SafePay Ransomware Works (products matched to the CVEs)
- Sygnia: Exfiltration in Plain Sight: SafePay’s OneDrive Play (March 10, 2026)
Photo: Sergei Starostin, Pexels (Pexels licence).