At least 600 organizations across critical infrastructure sectors have been hit by the SafePay ransomware group, leveraging weaknesses in remote access tools and backup systems, according to a joint advisory released on October 20, 2026. Active since August 2024, the group has been operating in North America, South America, Europe, and Australia, making it among the most prolific ransomware threats of 2026.
How SafePay Breaches Happen
SafePay picks its entry points carefully: exposed credentials, misconfigured remote access services, phishing campaigns, and software vulnerabilities are common conduits. Once inside a target network, attackers escalate privileges, hunt for sensitive files, sabotage recovery environments, then deploy encryption. Their tactics pressure victims not only with business disruption, but also by threatening to publish stolen data if demands aren’t met.
Authorities point to several exploited flaws. Edge devices have been compromised via CVE-2020-3259 and CVE-2023-20269, while internet-facing systems suffer from CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. A noteworthy attack vector involves using backup software flaws: the CVE-2024-40711 vulnerability in Veeam Backup & Replication allows remote code execution without authentication. In several incidents, attackers combined that flaw with stolen VPN credentials to build admin accounts. Use of VPN services like Mullvad was observed during intrusions—though there’s no sign the VPN itself was compromised.
Inside the Attack: Tactics and Tools
After gaining access, SafePay operations mirror more than just spray-and-pray attacks. The group creates new accounts or elevates existing ones, then uses trusted tools like PsExec, Windows Remote Management, and Remote Desktop Protocol to spread laterally. Shared folders are combed for sensitive material, antivirus solutions are disabled, user passwords are sometimes changed outright, and attackers occasionally evade Windows User Account Control and reuse security tokens to widen their reach.
Data theft tools like 7-Zip, WinRAR, RClone, WinSCP, FileZilla—and even integrated cloud storage services like OneDrive and Backblaze—play a role in exfiltration. For backups, the group doesn’t just leave them alone: they disable or reset services like Volume Shadow Copy, and in some cases factory-reset network-attached storage devices. Encryption uses a combination of ChaCha20 and RSA, applied either fully or partially depending on file type and size. Stolen data is leveraged to coerce payments, often accompanied by threats and even phone pressure; the malware may self-delete afterward.
Warning Signs & How Organizations Should Respond
Indicators of compromise include specific IP addresses associated with data exfiltration or victim intrusion, suspicious file patterns (such as locker.dll, winrar.exe, or tools like AnyDesk), and encrypted files with a .SafePay extension. Unexpected remote tool activity, new accounts with elevated permissions, or disruption of backup mechanisms also flag danger.
In guidance issued alongside the advisory, agencies urge organizations to patch exposed vulnerabilities, enforce multifactor authentication, and restrict administrator rights. Backup systems should be isolated from the rest of the network or protected from unauthorized modification or deletion. Regular testing of restore processes is essential. Segmentation between networks housing remote access accounts and recovery or sensitive servers can limit damage pathways. Log review, isolation of compromised machines, and scope investigations are critical if a breach is suspected. Experts discourage paying ransoms, as it doesn’t guarantee data return and risks fueling further criminal operations.
SafePay’s actions reflect a broader trend in ransomware: using overlooked vulnerabilities in backups and remote access as primary targets. What stands out is not just their geographic reach or volume of victims, but how they combine familiar tools with vulnerabilities many organizations assumed were covered. As defenses improve, attackers like SafePay will shift strategy—but the groundwork of protecting credentials, systems, and backups remains the frontline. What to watch next: whether newly patched vulnerabilities emerge, whether encryption methods evolve, and how willingness to negotiate with ransomware affects the threat landscape.
