The FBI, CISA and the US Secret Service, joined by Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the UK's North West Regional Organised Crime Unit, have published a joint #StopRansomware advisory on SafePay, a ransomware crew the agencies say has hit at least 600 victims across multiple critical infrastructure sectors since August 2024.
The advisory, AA26-293A, describes SafePay as among the most active ransomware groups of 2026, with victims in North America, South America, Europe and Australia. Its findings draw on FBI, Secret Service and Rhineland-Palatinate state police investigations as recently as August 2026, and the indicators it publishes were observed between November 2024 and August 2026.
Stolen logins and five known edge-device bugs
SafePay rarely needs anything novel to get in. The agencies say the crew gains initial access through exposed credentials, brute-force password guessing and VPN access, connecting from IP addresses belonging to the VPN provider Mullvad. Using phished account profiles, the actors exploit two Cisco Adaptive Security Appliance and Firepower Threat Defense flaws, CVE-2020-3259 (CVSS 7.5) and CVE-2023-20269 (CVSS 5.0).
The advisory also names three bugs SafePay exploits on internet-facing systems through automated scripts: CVE-2024-40711 in Veeam Backup and Replication (CVSS 9.8), CVE-2024-40766 in SonicWall SonicOS (CVSS 9.8), and CVE-2023-27532 in the Cloud Connect component of Veeam Backup and Replication (CVSS 7.5). All five are already listed in CISA's Known Exploited Vulnerabilities catalog.
Living off the land until the files lock
Once inside, SafePay operators take over existing accounts or create new ones with administrative rights, then move laterally with PsExec, Windows Remote Management, Remote Desktop and remote monitoring and management software. They map file shares with ShareFinder.ps1 and SharpShares.exe, disable security tools, and in some cases change user passwords so legitimate staff cannot log in. The agencies also observed a User Account Control bypass and token impersonation for privilege escalation.
Data is staged with 7-Zip, WinRAR and FileZilla, then pulled out with WinSCP, RClone, OneDrive and, in some cases, Backblaze's b2.exe command-line tool. Before encrypting, the crew stops the Volume Shadow Copy Service and resets network-attached storage holding backup data to factory settings. The encryptor combines a ChaCha20 stream cipher with RSA and appends a .SafePay extension. Victims then face a ransom demand typically pitched as a share of company revenue, phone calls from a group representative, and publication on SafePay's leak site if they do not pay.
The OneDrive habit has been documented before: IntelFusions reported in September on how SafePay's OneDrive exfiltration exposed other victims. Our SafePay actor profile tracks the group's activity.
Patch the edge, then lock down remote tools
The authoring agencies urge organizations to patch firewalls and other edge devices first, enforce multifactor authentication, restrict administrative tools and privileges to the people who need them, and apply zero trust principles. Because SafePay leans on legitimate software, defenders should audit for unexpected PsExec, WinRM, AnyDesk, TeamViewer, ScreenConnect and RClone use rather than relying on malware signatures alone, and keep offline backups that a factory reset of the storage array cannot reach.
Selected indicators from the advisory (the agencies recommend verifying IP addresses before blocking, as some belong to shared or legitimate services):
- 88[.]119[.]167[.]239 (soc.dll command and control)
- 5[.]255[.]11[.]134 and 37[.]10[.]71[.]188 (used in exfiltration)
- 167[.]235[.]225[.]149 (client login panels)
- SHA-256 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae (soc.dll)
- SHA-1 07353237350c35d6dc2c8f143b649cd07c71f62b (ransomware binary)
The full STIX indicator set is linked from the advisory. None of SafePay's entry points are new, and that is the uncomfortable part: by the agencies' own account, a crew counted at 600 victims is walking in through known bugs and stolen passwords.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.