SafePay Ransomware Hits 600 Victims: Patch VPNs, Veeam and Defend Windows Backups

What the advisory says​

The advisory is a joint product of the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), United States Secret Service (USSS), Germany's Landeskriminalamt Rheinland-Pfalz, the United Kingdom's National Crime Agency, and the United Kingdom's North West Regional Organised Crime Unit. Its stated purpose is to share SafePay's tactics, techniques and procedures (TTPs) and indicators of compromise (IOCs). These were identified through FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations as recently as August 2026.

According to CISA's summary, SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. BleepingComputer quoted CISA as calling SafePay one of the most active ransomware groups, with at least 600 victims in multiple critical infrastructure sectors.

A note on that number: some headlines say "600 critical infrastructure organizations." CybersecurityNews describes the advisory more precisely: at least 600 separate victims across multiple critical infrastructure sectors. The victims come from critical infrastructure sectors, but that doesn't mean every one is a power plant or a water utility. It's also a minimum. BleepingComputer notes that SafePay's leak site only lists victims who refuse to pay, so the real number of breached and extorted organizations is higher.

Summary: six agencies in three countries, at least 600 victims on four continents, and investigations running into August 2026.

Who SafePay is​

BleepingComputer describes SafePay as a private ransomware group with no affiliates, which is unusual. Most big operations rent their malware to partners under a ransomware-as-a-service model. SafePay appeared in August 2024 and, since early 2025, has gradually filled the gap left by the collapse of BlackCat (ALPHV) and LockBit. The Record notes that researchers have previously said parts of SafePay's code resemble LockBit's.

The group uses double extortion: it steals data first, encrypts systems second, and threatens to publish the stolen files if the victim doesn't pay. According to The Record, the advisory says SafePay demands a share of company revenue in cryptocurrency, and someone calls victims by phone to increase the pressure. GBHackers also reports that representatives also telephone victims to intensify pressure, while stolen information may be published on the group's leak site if payment is withheld.

The Record links SafePay to recent attacks on British tech company Microlise and on government contractor Conduent. The Conduent attack disrupted Medicaid, child support and toll services, and Conduent recently announced an $80 million settlement of a class action filed after the attack.

How they get in​

The advisory's own summary is simple: SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. BleepingComputer adds that the agencies specifically mention VPN access from IP addresses belonging to the commercial VPN provider Mullvad. That describes infrastructure the attackers used. It doesn't mean Mullvad was compromised, and it doesn't mean every Mullvad user is a threat. GBHackers notes that the advisory itself warns that legitimate tools or historical IP addresses require contextual verification before blocking.

The advisory lists five exploited vulnerabilities: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. Public vulnerability records, rather than the advisory excerpts reviewed here, map them to products:

None of these is new. All of them already have fixes. And two of the five target backup infrastructure, which says a lot about where SafePay aims. If an attacker owns your Veeam server, they can do far more than read your data. They can also take away your ability to recover.

Summary: stolen or guessed passwords, phishing, and old, already-patched flaws in VPNs, firewalls and backup servers.

What happens inside a Windows network​

After getting in, the advisory says, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection. Coverage of the advisory names PsExec, Windows Remote Management (WinRM) and Remote Desktop Protocol (RDP) for lateral movement. The Record reports that AnyDesk or TeamViewer are used to copy the ransomware onto machines, and that the attackers sometimes change users' passwords to lock them out. GBHackers says ShareFinder.ps1 and SharpShares.exe enumerate network shares, helping operators identify valuable information before exfiltration and encryption.

Then they go after recovery. In BleepingComputer's account, CISA warns that SafePay actors may delete shadow copies and reset network-attached storage (NAS) devices that hold backups. Finally, they encrypt the victim's files, making them inaccessible, and leave a ransom note demanding payment in cryptocurrency.

The pattern will be familiar to anyone who has investigated a hands-on-keyboard intrusion. Almost every step uses a tool your own staff uses on an ordinary Tuesday. That's why signature-based antivirus alone won't stop it.

What defenders should do​

The advisory's key actions are short: Regularly patch and update systems, especially firewalls, and other edge devices. Implement Zero Trust Principle. Restrict administrative tools and privileges to necessary users only. Strengthen account security by implementing identity, credential, and access management (ICAM) policies and multifactor authentication (MFA). GBHackers adds that CISA also recommends that organizations segment networks.

The following checklist turns that advice into concrete steps for Windows and hybrid environments. It's based on general industry practice, not wording from the advisory:

1. Check the five CVEs first. List every Cisco ASA/FTD, SonicWall and Veeam Backup & Replication instance you run, confirm each is on a fixed version, and work through the rest of CISA's Known Exploited Vulnerabilities (KEV) catalog for anything internet-facing.
2. Put MFA on every remote entry point. That means VPNs, RDP gateways, and admin portals on firewalls and backup consoles. A VPN that accepts a password alone is exactly what brute-force attacks look for.
3. Lock down admin tooling. Limit who can run PsExec, use WinRM or open RDP sessions, ideally from dedicated admin workstations only. Use application control, such as App Control for Business or AppLocker, to block remote-access tools like AnyDesk or TeamViewer where they have no business purpose.
4. Watch for identity changes. Alert on new account creation, new members of privileged groups, and unexpected password resets. In Windows Security logs, that means events 4720 (account created) and 4728/4732 (members added to security groups). Also watch System event 7045 (new service installed), which PsExec-style tools produce.
5. Alert on shadow copy deletion. Shadow copy deletion (for example, vssadmin delete shadows or WMI equivalents) is a classic sign that ransomware is about to run. Microsoft Defender for Endpoint and most EDR products can flag it.
6. Keep backups out of reach of domain credentials. Keep at least one copy offline or immutable, with separate credentials. Put management interfaces for backup servers and NAS devices on their own network segment, away from production.
7. Hunt using the advisory's IOCs. The advisory includes downloadable STIX threat data. Treat matches on IP addresses or legitimate tools as leads to investigate, not automatic verdicts.

Summary: patch the edge, enforce MFA, restrict admin tools, and protect backups from accounts the attacker may already control.

Paying, reporting and the bigger picture​

The agencies repeat their usual position on ransom payments, and the FBI's ransomware guidance is blunt: paying doesn't guarantee you'll get any data back, and it encourages more attacks. The advisory asks victims to report incidents whether they pay or not. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI's Internet Crime Complaint Center (IC3), a local FBI field office, a local USSS Field Office, or CISA. IC3's complaint form asks for the variant name, the file extension of encrypted files, cryptocurrency addresses, attacker contact details, the ransom amount, and whether you paid. If you're hit, start collecting those details early.

Is SafePay anything new? Not really, and that's the problem. Its main techniques are weak VPN authentication, flaws that were patched long ago, and abuse of normal admin tools. It has reached 600 known victims without any exotic zero-days. One criticism of these advisories is that they arrive late: investigations run to August 2026, and many victims were hit long before the guidance appeared. Even so, the advisory gives defenders a ready-made, prioritized list. Five CVEs, one VPN pattern and one set of Windows behaviors are a manageable amount of work.

For WindowsForum readers, the most useful related discussions are on hardening RDP and WinRM, Veeam and backup-server security, and setting up Defender for Endpoint alerts for shadow copy tampering. The advisory is long, but if you only have time for one thing, patch your edge devices and backup servers first.