CISA and FBI warn SafePay ransomware has hit at least 600 victims

The FBI, CISA, the U.S. Secret Service and partners in Germany and the U.K. released joint advisory AA26-293A on Oct. 20 detailing the SafePay ransomware group.

SafePay has affected at least 600 victims since August 2024.

The agencies say the group was among the most active ransomware operations in 2026, targeting businesses and critical infrastructure across North America, South America, Europe and Australia.

Initial access relies on stolen or guessed credentials, edge-device flaws and phishing.

Once inside, SafePay actors create new accounts or take over existing ones, use legitimate system tools to move through networks, locate valuable files and disable security protections, then encrypt data and demand payment in cryptocurrency.

The advisory lists five exploited vulnerabilities.

They are CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, affecting firewall, VPN and backup products.

The agencies urge patching edge devices and enforcing MFA.

Recommended steps include prompt patching of firewalls and other edge devices, Zero Trust controls, restricting administrative tools, multifactor authentication and offline backups. Indicators of compromise are published in STIX format alongside the advisory.