/
← Voltar ao feed
high critical infrastructure government business

CISA and partners publish #StopRansomware advisory on SafePay ransomware: 600+ victims, VPN and edge-device exploitation

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 16:18 · coletado há 8 horas

A joint #StopRansomware advisory (AA26-293A) from the FBI, CISA, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit details SafePay ransomware activity observed through August 2026. SafePay has been highly active since August 2024 and was among the most active ransomware groups of 2026. It has affected at least 600 victims across critical infrastructure and businesses in North America, South America, Europe and Australia. Initial access comes from stolen or guessed credentials, brute forcing, phishing, and exploitation of known edge-device vulnerabilities. Operations end in double extortion, with data exfiltration, encryption and phone calls to pressure victims.

Technical Details

  • Initial access: credential exposure, brute force [T1110], phished account profiles used over Mullvad VPN IP addresses, and automated exploitation of internet-exposed systems [T1190]. Listed CVEs: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766.
  • Persistence and privilege escalation: administrative privileges on existing accounts [T1098] or newly created accounts [T1136]; UAC bypass via COM [T1548.002]; token impersonation [T1134.001].
  • Lateral movement and discovery: living-off-the-land binaries such as PsExec and WinRM, plus RDP, remote management software, ShareFinder.ps1 and SharpShares.exe for share enumeration.
  • Defense evasion: security software is disabled, user passwords are changed, code is packed [T1027.002], and the ransomware may delete itself after encryption [T1070.004].
  • Exfiltration: FileZilla, 7-Zip, RClone, WinRAR, WinSCP and OneDrive. AnyDesk and TeamViewer are used to stage tooling.
  • Impact: Volume Shadow Copy Service is halted and NAS backup devices are factory-reset [T1490]. Files are encrypted [T1486] with a hybrid ChaCha20 and RSA scheme and given the .SafePay extension. Ransom is demanded in cryptocurrency, the note points to a TOR chat portal with a victim ID, and stolen data is posted on the SafePay leak site if the victim does not pay.
  • IOCs (IPs, files, hostnames) were observed between November 2024 and August 2026 and are provided as STIX XML/JSON. They are not reproduced in the article text. Some listed files are legitimate tools and should be verified before blocking.

Remediation

  • Prioritize patching known exploited vulnerabilities, especially on firewalls, VPNs and other edge devices, per CISA Binding Operational Directive 26-04.
  • Enforce ICAM policies and phishing-resistant MFA for webmail, VPNs and critical accounts; use long passwords (15-64 characters) and account lockouts.
  • Keep offline, encrypted, immutable backups and test restoration.
  • Segment networks, deploy EDR and network monitoring, and restrict administrative tools and privileges (least privilege, just-in-time access).
  • Audit Active Directory for new or unrecognized accounts, and restrict command-line and scripting activity.
  • If a compromise is detected, isolate hosts, threat hunt, report to the FBI (or Report Fraud in the UK), and use CISA's Eviction Strategies Tool.

Linha do tempo

  1. cisa.gov ↗ · pub. 19/10/2026 16:18 · coletado 20/10 16:00 primeiro registro

    CISA and partners publish #StopRansomware advisory on SafePay ransomware: 600+ victims, VPN and edge-device exploitation

    ler a análise desta fonte

    A joint #StopRansomware advisory (AA26-293A) from the FBI, CISA, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit details SafePay ransomware activity observed through August 2026. SafePay has been highly active since August 2024 and was among the most active ransomware groups of 2026. It has affected at least 600 victims across critical infrastructure and businesses in North America, South America, Europe and Australia. Initial access comes from stolen or guessed credentials, brute forcing, phishing, and exploitation of known edge-device vulnerabilities. Operations end in double extortion, with data exfiltration, encryption and phone calls to pressure victims.

    Technical Details

    • Initial access: credential exposure, brute force [T1110], phished account profiles used over Mullvad VPN IP addresses, and automated exploitation of internet-exposed systems [T1190]. Listed CVEs: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766.
    • Persistence and privilege escalation: administrative privileges on existing accounts [T1098] or newly created accounts [T1136]; UAC bypass via COM [T1548.002]; token impersonation [T1134.001].
    • Lateral movement and discovery: living-off-the-land binaries such as PsExec and WinRM, plus RDP, remote management software, ShareFinder.ps1 and SharpShares.exe for share enumeration.
    • Defense evasion: security software is disabled, user passwords are changed, code is packed [T1027.002], and the ransomware may delete itself after encryption [T1070.004].
    • Exfiltration: FileZilla, 7-Zip, RClone, WinRAR, WinSCP and OneDrive. AnyDesk and TeamViewer are used to stage tooling.
    • Impact: Volume Shadow Copy Service is halted and NAS backup devices are factory-reset [T1490]. Files are encrypted [T1486] with a hybrid ChaCha20 and RSA scheme and given the .SafePay extension. Ransom is demanded in cryptocurrency, the note points to a TOR chat portal with a victim ID, and stolen data is posted on the SafePay leak site if the victim does not pay.
    • IOCs (IPs, files, hostnames) were observed between November 2024 and August 2026 and are provided as STIX XML/JSON. They are not reproduced in the article text. Some listed files are legitimate tools and should be verified before blocking.

    Remediation

    • Prioritize patching known exploited vulnerabilities, especially on firewalls, VPNs and other edge devices, per CISA Binding Operational Directive 26-04.
    • Enforce ICAM policies and phishing-resistant MFA for webmail, VPNs and critical accounts; use long passwords (15-64 characters) and account lockouts.
    • Keep offline, encrypted, immutable backups and test restoration.
    • Segment networks, deploy EDR and network monitoring, and restrict administrative tools and privileges (least privilege, just-in-time access).
    • Audit Active Directory for new or unrecognized accounts, and restrict command-line and scripting activity.
    • If a compromise is detected, isolate hosts, threat hunt, report to the FBI (or Report Fraud in the UK), and use CISA's Eviction Strategies Tool.