---
title: #StopRansomware advisory on SafePay: 600+ victims since Aug 2024, in through stolen or guessed passwords, Cisco ASA/FTD VPN bugs and old Veeam and SonicWall flaws | ctxsec
url: https://ctxsec.com/items/aa26-293a-safepay-ransomware
description: "FBI, CISA, the US Secret Service, Germany's LKA Rheinland-Pfalz and the UK's NCA and North West ROCU published AA26-293A on SafePay ransomware: at least 600 victims since August 2024, initial access via credentials, brute force, phishing and five known edge and backup CVEs, then LOTL movement, rclone/WinSCP exfiltration and NAS backup wipes before encryption."
status: "confirmed (joint FBI/CISA/USSS/German/UK advisory AA26-293A)"
published: 2026-10-20
---

> FBI, CISA, the US Secret Service, Germany's LKA Rheinland-Pfalz and the UK's NCA and North West ROCU published AA26-293A on SafePay ransomware: at least 600 victims since August 2024, initial access via credentials, brute force, phishing and five known edge and backup CVEs, then LOTL movement, rclone/WinSCP exfiltration and NAS backup wipes before encryption.

[← Cybersecurity News](/news) · [markdown](/items/aa26-293a-safepay-ransomware.md)

confirmed (joint FBI/CISA/USSS/German/UK advisory AA26-293A)

2026-10-20

### #StopRansomware advisory on SafePay: 600+ victims since Aug 2024, in through stolen or guessed passwords, Cisco ASA/FTD VPN bugs and old Veeam and SonicWall flaws

On **Oct 20** the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit released [#StopRansomware advisory AA26-293A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a) on **SafePay**. The agencies say SafePay has been active since August 2024, was among the most active ransomware groups in 2026, and has hit **at least 600 victims** across critical-infrastructure sectors in North America, South America, Europe and Australia. The TTPs and IOCs come from investigations as recent as August 2026.

- **Initial access:** exposed or brute-forced credentials and phishing, often from Mullvad VPN addresses. With phished accounts they exploit Cisco ASA/FTD bugs **CVE-2020-3259** and **CVE-2023-20269**. Automated scripts hit internet-facing **Veeam Backup & Replication** (**CVE-2023-27532**, **CVE-2024-40711**) and **SonicWall SonicOS** (**CVE-2024-40766**). All five are old, patched and already on KEV.
- **Inside:** new or hijacked admin accounts, PsExec, WinRM, RDP and RMM tools, ShareFinder.ps1 and SharpShares for share discovery, Mimikatz, UAC bypass and token impersonation, disabling security tools, and sometimes changing users' passwords to lock them out.
- **Exfiltration and impact:** 7-Zip, WinRAR, FileZilla, WinSCP, rclone, OneDrive and Backblaze `b2.exe`. Before encrypting (ChaCha20 plus RSA, `.SafePay` extension) they stop Volume Shadow Copy and **factory-reset NAS devices holding backups**. The ransom note points to a Tor chat portal, the group phones victims to pressure them, and the binary may delete itself afterwards.

**Do now:** make sure ASA/FTD, Veeam B&R and SonicWall are patched and their management interfaces are not internet-facing. Enforce phishing-resistant MFA on VPN and remote access, keep at least one backup copy offline or immutable and off the domain, and pull the STIX IOCs into your tooling. Several listed IPs belong to GitHub, Cloudflare and Google, so check before you block (see the hunt item).

Sources: [CISA AA26-293A: #StopRansomware: SafePay Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a) · [AA26-293A PDF](https://www.cisa.gov/sites/default/files/2026-10/aa26-293a-stopransomware-safepay-ransomware-508c.pdf) · [AA26-293A STIX JSON](https://www.cisa.gov/sites/default/files/2026-10/AA26-293A-stix.json) · [CISA on X](https://x.com/CISAgov/status/2112618996755218927)