FBI, CISA AND INTERNATIONAL LAW ENFORCEMENT WARN SAFEPAY RANSOMWARE HAS COMPROMISED AT LEAST 600 ORGANIZATIONS WORLDWIDE

WASHINGTON, D.C. — Federal cybersecurity authorities and international law enforcement agencies have issued a joint warning about SafePay ransomware, a financially motivated cybercriminal operation responsible for compromising at least 600 organizations across multiple industries and critical infrastructure sectors. The group has exploited vulnerable systems, stolen credentials, disabled security protections, and encrypted business data while demanding cryptocurrency payments from victims.

The October 20, 2026, advisory, designated AA26-293A, was jointly published by the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), U.S. Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency, and the United Kingdom’s North West Regional Organised Crime Unit.

The alert incorporates investigative findings collected as recently as August 2026 and identifies SafePay as one of the most active ransomware groups operating this year. Since August 2024, its activities have affected organizations throughout North America, South America, Europe, and Australia, including businesses responsible for essential services and infrastructure.

According to the participating agencies, SafePay attackers frequently gain initial access through compromised account credentials, password-guessing attacks, improperly secured virtual private network connections, and exploitation of known software vulnerabilities. Investigators identified five vulnerabilities associated with the group’s intrusion activity: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.

These vulnerabilities involve weaknesses in information exposure, authentication controls, software deserialization, and access restrictions. Their exploitation can provide attackers with opportunities to enter exposed systems or bypass protections intended to prevent unauthorized access.

The advisory identifies attacks involving internet-facing infrastructure, including remote-access systems and network security devices. SafePay operators have also used compromised account profiles and VPN infrastructure associated with Mullvad to conceal or route their connections into targeted environments.

Once access has been established, the attackers attempt to gain administrative privileges by taking control of existing accounts or creating new ones. Rather than relying exclusively on custom malicious software, SafePay frequently uses legitimate Windows administration utilities to conduct operations inside compromised networks.

Investigators documented the use of PsExec, Windows Remote Management (WinRM), Remote Desktop Protocol (RDP), and remote monitoring and management software to execute commands and move between connected systems. These tools are commonly used for authorized administration, making it essential for defenders to distinguish legitimate activity from unauthorized operations.

The group also uses PowerShell scripts and network enumeration utilities, including ShareFinder.ps1 and SharpShares.exe, to identify shared folders, accessible servers, and other locations containing valuable organizational information.

The joint investigation also identified privilege-escalation techniques involving Windows User Account Control bypasses and token impersonation. These methods can allow malicious processes to operate with elevated permissions and access functions ordinarily restricted to authorized administrators.

Before deploying ransomware, SafePay attackers commonly interfere with security defenses. Investigators observed attempts to disable protective software, manipulate system configurations, and conceal executable files through packing and other code-obfuscation methods.

Data theft represents another major component of the operation. SafePay uses legitimate file compression and transfer applications, including 7-Zip, WinRAR, FileZilla, RClone, and WinSCP, to collect information and transfer it outside compromised networks.

The agencies also documented instances involving Microsoft OneDrive and Backblaze B2 cloud storage for unauthorized data transfers. Other legitimate applications, including AnyDesk, TeamViewer, and ScreenConnect, have been used to maintain remote access or move malicious files onto affected computers.

SafePay’s operations also target backup and recovery capabilities. Federal investigators observed attackers stopping the Windows Volume Shadow Copy Service and, in some cases, resetting network-attached storage devices containing backup data to their original factory configurations.

After collecting and transferring data, SafePay deploys ransomware that encrypts files using a combination of ChaCha20 and RSA cryptographic technologies. The malware can perform full or partial encryption depending on the type and size of the targeted files, and affected files receive the .SafePay extension.

Victims typically discover ransom instructions placed on their desktops or within affected directories. The messages direct them to communicate with the attackers through a Tor-based portal using a unique victim identifier.

The criminal group generally demands payment in cryptocurrency, with the requested amount often determined by a portion of the victim organization’s revenue. Investigators also documented telephone calls intended to pressure organizations into complying with ransom demands.

The group’s activities extend beyond preventing access to encrypted systems. When victims refuse payment, SafePay operators may publish stolen information through a dedicated data-leak website, creating additional pressure involving confidential business records, personal information, and potential regulatory consequences.

The participating agencies released technical indicators to help security teams identify possible SafePay activity. The advisory contains suspicious IP addresses, filenames, cryptographic hashes, and other artifacts gathered from investigations conducted between November 2024 and August 2026.

Among the identified network indicators are IP addresses associated with victim intrusions, data exfiltration, attacker-controlled login infrastructure, and command-and-control activity. The technical findings are also mapped to the MITRE ATT&CK framework to help defenders recognize specific tactics and techniques associated with the group.

The agencies caution that individual indicators require investigation before being classified as malicious. An IP address, filename, or legitimate administrative utility may appear in authorized activity, and organizations should evaluate the surrounding evidence rather than automatically treating every match as proof of compromise.

For organizations that suspect SafePay has entered their networks, the advisory recommends isolating affected systems, preserving forensic evidence, examining authentication and administrative activity, and identifying unauthorized accounts or persistence mechanisms before restoring normal operations.

Security teams are also advised to prioritize remediation of known exploited vulnerabilities, particularly on internet-facing systems such as firewalls, VPN appliances, and remote-access infrastructure.

Additional recommendations include enforcing multifactor authentication, restricting privileged accounts, applying zero-trust access principles, strengthening credential management, and maintaining current software and firmware updates.

The agencies place particular emphasis on reliable backup protection. Organizations should maintain encrypted, immutable, and offline backups, regularly test restoration procedures, and ensure that backup systems cannot be modified or erased through the same administrative access available to production networks.

Network segmentation, endpoint detection and response tools, centralized logging, and the examination of unusual remote administration activity are also recommended to reduce opportunities for attackers to move through compromised environments.

The advisory encourages organizations to validate their defenses against the documented SafePay techniques instead of assuming that installed security products will automatically prevent intrusions. Testing can identify weaknesses in detection, account restrictions, backup protections, and incident response procedures before an attack occurs.

The FBI and participating agencies continue seeking information that could support investigations into SafePay operations, including ransom notes, suspicious network activity, cryptocurrency transaction details, malicious files, and evidence of unauthorized access.

Federal authorities discourage ransom payments because transferring funds does not guarantee that encrypted files will be recovered or that stolen information will remain private. Payment may also provide financial resources for additional criminal operations.

Organizations experiencing SafePay-related incidents are encouraged to report the activity to the FBI, CISA, the U.S. Secret Service, or the appropriate law enforcement authorities in their jurisdiction.

The October 20 advisory establishes a documented pattern of SafePay activity involving at least 600 victims and provides updated technical evidence of the group’s intrusion methods, administrative abuse, data theft, and ransomware deployment.

---

---

Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), U.S. Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, United Kingdom’s National Crime Agency (NCA), and North West Regional Organised Crime Unit (NWROCU), #StopRansomware: SafePay Ransomware. Joint Cybersecurity Advisory AA26-293A, October 20, 2026. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---