VULNpocalypse
HighBreach / campaignOngoing

CISA, FBI and partners warn SafePay ransomware has hit at least 600 critical-infrastructure victims

Joint advisory AA26-293A: SafePay ransomware has hit 600+ organisations since Aug 2024. Patch the five named CVEs, require MFA, keep offline backups.

Published
Updated
Exploitation
Yes. CISA, FBI, USSS and partners attribute at least 600 compromised victims to SafePay, with intrusions observed between November 2024 and August 2026

What happened

  • 20 October 2026: CISA, the FBI, the U.S. Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, and the UK’s National Crime Agency and North West Regional Organised Crime Unit released joint advisory AA26-293A, “#StopRansomware: SafePay Ransomware” (CISA).
  • The advisory says SafePay actors have compromised at least 600 separate victims across multiple critical-infrastructure sectors (CISA). The accompanying press release puts the figure at “approximately 600 victims” in the Americas, Europe, and Australia (CISA press release).
  • SafePay has been active since August 2024, targeting North America, South America, Europe, and Australia (CISA).
  • Infosecurity Magazine reports SafePay was the most active ransomware group in May 2026 with 70 claimed attacks, and that it is believed responsible for the November 2024 Conduent attack, over which Conduent agreed on 16 October 2026 to pay $80m to settle a class action (Infosecurity Magazine).

Tactics / IOCs

Initial access. SafePay gains entry through credential exposure and stolen or guessed passwords, brute-force password attacks, VPN access abuse (including Mullvad VPN IP addresses), phishing, and automated scripts that exploit internet-exposed systems (CISA). The press release summarises this as compromising credentials and “targeting known vulnerabilities in internet-facing devices, often connecting through VPN services” (CISA press release).

CVEs exploited. The advisory lists five (CISA):

  • CVE-2020-3259 (CWE-200)
  • CVE-2023-20269 (CWE-288)
  • CVE-2023-27532 (CWE-306)
  • CVE-2024-40711 (CWE-502)
  • CVE-2024-40766 (CWE-284)

Post-compromise TTPs. SafePay seeks administrative privileges on existing or newly created accounts, lives off the land, and disables security software. Named tools and techniques include (CISA):

  • Lateral movement and remote access: PsExec, WinRM, RDP, and remote management software; payload delivery via AnyDesk, TeamViewer and ScreenConnect.
  • Discovery and credential theft: ShareFinder.ps1 and SharpShares.exe for share enumeration, Mimikatz for credential dumping, and NetExec.
  • Defense evasion: UAC bypass via COM, token impersonation, software packing, and file deletion after intrusion.
  • Collection and exfiltration: 7-Zip, WinRAR and RClone for staging; FileZilla, WinSCP, RClone, OneDrive and Backblaze b2.exe for exfiltration.
  • Inhibiting recovery: stopping Volume Shadow Copy Service and resetting NAS devices that hold backups to factory settings.

Infosecurity Magazine adds that SafePay may be a rebrand of LockBit, ALPHV/BlackCat and INC Ransomware (Infosecurity Magazine).

Encryption and extortion. SafePay uses a hybrid scheme combining a ChaCha20 stream cipher with RSA public-key exchange; encrypted files get a .SafePay extension. Data is stolen before encryption (double extortion); the ransom note is placed on the desktop or root directory and directs victims to a TOR .onion chat portal using a victim ID, demanding a subset of company revenue in cryptocurrency. A group representative phones victims to increase pressure, and unpaid data is posted to a leak site (CISA; Infosecurity Magazine).

IOCs. The advisory publishes indicators observed between November 2024 and August 2026, and warns that IP addresses should be verified before blocking and that some listed files are legitimate tools. A sample (CISA):

  • IPs (as published): 88.119.167[.]239 (soc.dll command and control), 5.255.11[.]134 and 37.10.71[.]188 (exfiltration), 167.235.225[.]149 (client login panels).
  • SHA-256: 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae (soc.dll); SHA-1: 07353237350c35d6dc2c8f143b649cd07c71f62b (1.exe ransomware binary).
  • Suspicious filenames: locker.dll, dcsync.exe, netscan.exe, sharefinder.ps1, b2.exe, nxc.exe, and svchost.exe found outside System32.

The advisory does not list a ransom note filename (CISA).

What to do

CISA’s recommended mitigations (CISA; CISA press release):

  1. Patch promptly, prioritising known exploited vulnerabilities on internet-facing systems and edge devices (see BOD 26-04), including the five CVEs above.
  2. Implement ICAM policies and require MFA for all services, especially webmail, VPNs and critical system accounts.
  3. Enforce strong passwords per NIST digital identity guidelines: 15 to 64 characters, hashed storage, no reuse, lockouts after repeated failures, no password hints, and no forced changes more than once a year.
  4. Keep offline, encrypted, immutable backups covering the whole data estate, and test restoration regularly.
  5. Maintain a recovery plan with multiple copies of critical data in separate, secure locations.
  6. Segment networks to limit lateral movement, and monitor traffic with EDR to detect it.
  7. Filter traffic so untrusted sources cannot reach internal remote-access services, and disable unused ports.
  8. Review Active Directory, domain controllers, servers and workstations for unrecognised accounts; audit admin accounts and apply least privilege with just-in-time, time-limited access.
  9. Conduct forensic triage to determine whether systems have been compromised, and validate defences against the advisory’s MITRE ATT&CK techniques.

Sources