Six agencies warn SafePay ransomware has hit at least 600 critical infrastructure organisations since August 2024

In 30 seconds

Six agencies from the US, Germany and the UK have issued a joint advisory on SafePay, attributing at least 600 victims in critical infrastructure sectors to the group since August 2024.

• What happened: on 20 October CISA released #StopRansomware advisory AA26-293A, detailing the group's techniques and five known vulnerabilities in VPNs, firewalls and backup software.
• Who is affected: organisations in North America, South America, Europe and Australia, especially those running unpatched Cisco ASA/FTD, SonicWall devices or Veeam Backup & Replication servers.
• What to do now: patch those five CVEs, all in CISA's KEV catalogue, enforce MFA on remote access and check that backups are isolated and offline.

What happened

The advisory is co-signed by CISA, the FBI and the US Secret Service together with the criminal police of the German state of Rhineland-Palatinate (LKA Rheinland-Pfalz), the UK's National Crime Agency and the North West Regional Organised Crime Unit. According to CISA's official bulletin, SafePay has affected businesses and critical infrastructure in four regions, 'including at least 600 organizations from multiple critical infrastructure sectors since August 2024'. The agencies call it one of the most active ransomware groups.

As BleepingComputer reports, the techniques come from FBI, Secret Service and LKA investigations into activity observed between November 2024 and August 2026. To get in, the group uses exposed credentials, password brute forcing, VPN access, particularly from IP addresses of the provider Mullvad, phished accounts and automated scripts targeting vulnerabilities in edge devices and other internet-facing systems.

According to the bulletin, the attackers may delete volume shadow copies and factory-reset NAS devices holding backups. They run double extortion and, in some cases, phone victims directly. The Record, quoting the advisory, says they demand 'a subset of company revenue' in cryptocurrency.

• August 2024: the group emerges, according to CISA (NCC Group says it has been active since November 2024).
• May 2025: NCC Group ranks it the most active group of the month, with 70 attacks (18% of the total).
• Early September 2026: Deutsche Telekom detects SafePay activity and cleans up a T-Systems test system.
• 5 October 2026: extortion attempts against T-Systems begin, according to the company.
• 16 October 2026: Conduent agrees to an $80 million fund to settle a class action over its breach.
• 20 October 2026: CISA publishes advisory AA26-293A.

What is confirmed and what is not

The full advisory page could not be accessed directly; verified points come from CISA's official bulletin and the outlets cited.

• Confirmed (CISA bulletin): at least 600 organisations since August 2024. Headlines saying 'over 600' or limiting the scope to the US and Europe do not match the official text.
• Confirmed (NVD and CISA KEV, according to Orbitaley data): the five CVEs the press cites from the advisory, CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, are in KEV with known ransomware use.
• Unconfirmed: whether the CVE list is longer; The Record adds 'and others'.
• Confirmed by the company: Deutsche Telekom told Cybernews it found ransomware on 'a small test system', isolated and cleaned it, and that the stolen data is mainly slides and log files with no sensitive information.
• Not confirmed by the company: SafePay's role in the Conduent incident. The Record says the group claimed it; Conduent's 8-K refers to a January 2025 incident (the press dates it to November 2024), does not name the group, and the company denies fault or liability.
• Disputed: BleepingComputer and Cybernews describe a closed group with no affiliates; an excerpt of the Basque Cybersecurity Centre's profile calls it RaaS.
• Hypothesis, not attribution: links to LockBit, ALPHV, INC or Conti mentioned by NCC Group, The Record and Cybernews.

Why it matters

SafePay goes after what an organisation needs to recover. Two of the CVEs affect Veeam Backup & Replication: CVE-2024-40711 (CVSS 9.8) allows unauthenticated remote code execution (RCE), and CVE-2023-27532 exposes encrypted credentials stored in its configuration database. According to Orbitaley data, FIRST gives them a 90.4% and 81.3% probability of exploitation within 30 days, and both have public exploits on record.

The other three sit at the front door: CVE-2020-3259 and CVE-2023-20269 in Cisco ASA and Firepower Threat Defense (the latter, in the remote access VPN, enables credential brute forcing) and CVE-2024-40766 (CVSS 9.8) in SonicWall SonicOS management access. CISA added them to KEV between 2023 and 2024: the group exploits devices left unpatched for a long time.

According to Orbitaley's profile, SafePay also gets in through misconfigured Fortinet firewalls that allow VPN MFA to be bypassed, exposed RDP, email bombing followed by Microsoft Teams calls impersonating IT support, and purchased access, and usually moves from access to encryption in one or two days. BleepingComputer says it only lists victims who do not pay, so the real count is likely higher.

What organisations can do

The key actions in the official bulletin are patching, prioritising VPNs, firewalls and edge devices in KEV; strengthening identity, credential and access management (ICAM) with MFA; and restricting administrative tools to those who need them.

• Veeam: apply the fixes in vendor advisories KB4424 (CVE-2023-27532) and KB4649 (CVE-2024-40711) and confirm versions against the vendor's documentation.
• SonicWall: per NVD, CVE-2024-40766 affects Gen 5 and Gen 6 devices and Gen 7 devices running SonicOS 7.0.1-5035 or older; check advisory SNWLID-2024-0015. For Cisco ASA/FTD, consult Cisco's advisories.
• Logs: repeated VPN authentication attempts, logins from Mullvad IP addresses, new accounts or unrequested password changes, stopped shadow copy services and NAS resets.
• Exfiltration: Rclone, WinRAR, 7-Zip or FileZilla where they should not be, according to Orbitaley's profile; the advisory text reported by trade press adds WinSCP, AnyDesk and TeamViewer.
• Backups that are offline, encrypted, immutable and physically separate, with tested restores, according to Infosecurity Magazine's summary.
• Indicators: the advisory includes network IOCs and a STIX file; review them in context before blocking, as the table could not be verified at the primary source.
• ATT&CK mitigations covering most of the group's techniques, according to Orbitaley's profile: M1026, M1027, M1018, M1017, M1042 and M1015.
• Report incidents: the agencies note that paying does not guarantee file recovery.

What to watch

There is no breakdown of the 600 victims by country, sector or size, and no specific victim has been officially linked to the advisory. There is no sign of arrests from the investigations and no statement of their own from the LKA or the NCA.

Watch whether Conduent attributes its incident to SafePay and clarifies the date, whether the full advisory confirms more CVEs, and how exploitation of the Veeam flaws evolves now that public exploits exist. In Spain, Escudo Digital has reported claims against two companies, which they have not confirmed.

Vulnerabilities (5)