On Oct 20 the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit released #StopRansomware advisory AA26-293A on SafePay. The agencies say SafePay has been active since August 2024, was among the most active ransomware groups in 2026, and has hit at least 600 victims across critical-infrastructure sectors in North America, South America, Europe and Australia. The TTPs and IOCs come from investigations as recent as August 2026.

• Initial access: exposed or brute-forced credentials and phishing, often from Mullvad VPN addresses. With phished accounts they exploit Cisco ASA/FTD bugs CVE-2020-3259 and CVE-2023-20269. Automated scripts hit internet-facing Veeam Backup & Replication (CVE-2023-27532, CVE-2024-40711) and SonicWall SonicOS (CVE-2024-40766). All five are old, patched and already on KEV.
• Inside: new or hijacked admin accounts, PsExec, WinRM, RDP and RMM tools, ShareFinder.ps1 and SharpShares for share discovery, Mimikatz, UAC bypass and token impersonation, disabling security tools, and sometimes changing users' passwords to lock them out.
• Exfiltration and impact: 7-Zip, WinRAR, FileZilla, WinSCP, rclone, OneDrive and Backblaze b2.exe. Before encrypting (ChaCha20 plus RSA, .SafePay extension) they stop Volume Shadow Copy and factory-reset NAS devices holding backups. The ransom note points to a Tor chat portal, the group phones victims to pressure them, and the binary may delete itself afterwards.

Do now: make sure ASA/FTD, Veeam B&R and SonicWall are patched and their management interfaces are not internet-facing. Enforce phishing-resistant MFA on VPN and remote access, keep at least one backup copy offline or immutable and off the domain, and pull the STIX IOCs into your tooling. Several listed IPs belong to GitHub, Cloudflare and Google, so check before you block (see the hunt item).