CISA and partners warn SafePay ransomware has hit 600+ organizations since Aug 2024, via edge-device exploits and backup destruction

Linha do tempo

1. hipaajournal.com ↗ · pub. 21/10/2026 11:02 · coletado 21/10 12:01

   CISA, FBI, USSS and German and UK agencies warn of SafePay ransomware, behind Conduent breach affecting 62.2M people

   Beyond the advisory details already tracked, this article adds the Conduent Business Services breach attributed to SafePay: about 8.5 TB exfiltrated and 62.2 million individuals affected, ranking as the third-largest U.S. healthcare data breach. It also notes the group's first attack came roughly two months after it was first identified.

   ler a análise desta fonte ocultar

   Beyond the advisory details already tracked, this article adds the Conduent Business Services breach attributed to SafePay: about 8.5 TB exfiltrated and 62.2 million individuals affected, ranking as the third-largest U.S. healthcare data breach. It also notes the group's first attack came roughly two months after it was first identified.

   CISA, the FBI, the U.S. Secret Service and cybersecurity agencies in Germany and the United Kingdom issued a joint advisory on the SafePay ransomware group. SafePay is a financially motivated double-extortion group that has been active since August 2024 and targets businesses and critical infrastructure in North and South America, Europe and Australia. It has attacked more than 600 entities. Two months after it was first identified, it breached Conduent Business Services, exfiltrating 8.5 TB of data. Conduent reported 62.2 million affected individuals, making it the third-largest U.S. healthcare data breach on record.

   Technical Details

   • Initial access: brute force password attacks, exposed credentials, and exploitation of edge devices: Cisco ASA (CVE-2023-20269, CVE-2020-3259), Veeam Backup & Replication (CVE-2023-27532, CVE-2024-40711) and SonicWall SonicOS (CVE-2024-40766). VPNs are also targeted, notably Mullvad VPN, using phished account profiles.
   • Post-compromise: actors take over existing accounts or create new ones and use legitimate system tools for credential theft, network scanning, lateral movement and data exfiltration.
   • Impact: valuable files are identified and exfiltrated, security protections are disabled, files are encrypted and ransom notes are dropped.
   • IoCs and detailed TTPs are published in the advisory itself.

   Remediation

   • Patch and update systems regularly, prioritizing the CVEs above and other known exploited vulnerabilities (KEVs).
   • Restrict administrative tools and privileges and implement Zero Trust principles.
   • Strengthen account security with ICAM policies and multifactor authentication.
2. infosecurity-magazine.com ↗ · pub. 21/10/2026 08:00 · coletado 21/10 08:01

   CISA, Germany and UK advisory: SafePay ransomware has compromised at least 600 critical infrastructure victims

   ler a análise desta fonte ocultar

   A joint advisory from US, German and UK government agencies, including CISA, says the SafePay ransomware group has compromised at least 600 critical infrastructure organizations since emerging in August 2024. Victims are in North America, South America, Europe and Australia. SafePay has been one of the most active ransomware groups in 2026. BlacKite ranked it third in the first four months of the year, with a focus on Germany, and NCC Group ranked it first in May 2026 with 70 claimed attacks. It may be a rebrand of LockBit, ALPHV/BlackCat and INC Ransomware. It is also believed to be behind the November 2024 attack on Conduent, which exposed personal and healthcare data and led to an $80m class action settlement on October 16, 2026.

   Technical Details

   • Initial access: exposed credentials, brute force password attacks, exploitation of VPN access and exploitation of vulnerabilities in edge devices.
   • Post-compromise: the actors seek administrative privileges on existing or newly created accounts. They move laterally with living-off-the-land tools (PsExec, WinRM, RMM software) and RDP.
   • Defense evasion: they disable security software and use software packing or virtual machine software protection to conceal code.
   • Exfiltration: legitimate tools such as FileZilla, OneDrive, 7-Zip, RClone and WinRAR move data to attacker-controlled accounts.
   • Encryption: hybrid scheme combining a ChaCha20 stream cipher with RSA public-key cryptography.
   • Extortion: double extortion. A ransom note directs victims to a TOR .onion chat portal using a victim ID. The group demands a share of company revenue in cryptocurrency and phones victims to add pressure. Data is posted to a leak site if the victim does not pay.

   Remediation

   • Prioritize patching known exploited vulnerabilities and keep operating systems, software and firmware up to date.
   • Implement ICAM policies and require MFA on all accounts.
   • Maintain offline backups that are encrypted, immutable and regularly tested, with multiple copies stored in a physically separate, segmented and secure location.
   • Segment networks to limit ransomware spread.
   • Use network monitoring to detect abnormal activity and lateral movement.
3. bleepingcomputer.com ↗ · pub. 21/10/2026 05:36 · coletado 21/10 06:00

   CISA and partners: SafePay ransomware has breached over 600 critical infrastructure organizations since August 2024

   ler a análise desta fonte ocultar

   CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and the UK's National Crime Agency and North West Regional Organised Crime Unit issued a joint advisory on the SafePay ransomware group. SafePay has breached at least 600 critical infrastructure organizations across North America, South America, Europe and Australia since August 2024. It emerged in August 2024 as a private group with no affiliates, and since early 2025 it has filled the gap left by BlackCat (ALPHV) and LockBit. It uses double extortion, and its leak site lists only victims who refuse to pay, so the real victim count is higher. The advisory includes IOCs and TTPs from FBI, USSS and Landeskriminalamt Rheinland-Pfalz investigations covering November 2024 to August 2026.

   Technical Details

   • Initial access comes from exposed credentials, brute force password attacks, and abuse of VPN access, particularly IP addresses of the VPN provider Mullvad.
   • Operators also use phished account profiles and automated scripts to exploit known CVEs in edge devices and other internet-exposed systems. The article names no specific CVEs.
   • Before encryption, the actors steal sensitive documents for double extortion.
   • To disrupt recovery, they delete shadow copies and reset network-attached storage devices that hold backups.

   Remediation

   • Restrict administrative tools and privileges to block lateral movement after compromise.
   • Implement MFA and identity, credential and access management (ICAM) policies.
   • Patch VPNs, firewalls and other edge devices promptly, prioritizing flaws in CISA's Known Exploited Vulnerabilities catalog.
   • Protect backups against deletion or reset.
   • Report incidents to law enforcement. Paying a ransom does not guarantee file recovery.
4. gbhackers.com ↗ · pub. 21/10/2026 04:07 · coletado 21/10 05:00

   CISA advisory: SafePay ransomware has hit 600+ organizations and destroys backups via VSS shutdown and NAS factory resets

   This article adds a few operational details beyond the base advisory summary: exfiltration to Backblaze B2 using b2.exe, documented cases where all NAS-attached company backups were deleted, ransom demands typically set as a portion of company revenue, and the note that CVE-2024-40766 affects SonicWall SonicOS. It also frames the advisory as covering investigative findings collected through August 2026.

   ler a análise desta fonte ocultar

   This article adds a few operational details beyond the base advisory summary: exfiltration to Backblaze B2 using b2.exe, documented cases where all NAS-attached company backups were deleted, ransom demands typically set as a portion of company revenue, and the note that CVE-2024-40766 affects SonicWall SonicOS. It also frames the advisory as covering investigative findings collected through August 2026.

   A joint advisory published on October 20, 2026 by CISA, the FBI, the United States Secret Service and German and UK law enforcement says SafePay ransomware actors have compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe and Australia since August 2024. The findings cover investigations through August 2026. SafePay combines data theft and encryption with deliberate sabotage of backup systems to hinder recovery, then adds pressure through phone calls and leak-site publication. Initial access comes from exposed credentials, phishing, brute force and vulnerable internet-facing systems, with connections observed from Mullvad VPN addresses.

   Technical Details

   • Exploited CVEs: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 (unauthenticated RCE via deserialization of untrusted data, CVSS 9.8) and CVE-2024-40766 (SonicWall SonicOS management access, with possible unauthorized resource access and firewall crashes).
   • Persistence and privilege escalation: new accounts are created or admin privileges are obtained on existing accounts; UAC bypass and token impersonation are used.
   • Lateral movement and discovery: PsExec, Windows Remote Management and RDP; ShareFinder.ps1 and SharpShares.exe enumerate network shares.
   • Defense evasion: security software is disabled, user passwords are sometimes changed, and software packing and virtual machine protection conceal the code. AnyDesk and TeamViewer help deliver the ransomware and supporting tools.
   • Exfiltration: WinSCP and RClone (OneDrive in some cases), staged archives built with 7-Zip and WinRAR, and exfiltration to Backblaze B2 using b2.exe.
   • Impact: the Volume Shadow Copy Service is stopped and NAS devices holding backups are reset to factory settings; in some cases all NAS-based company backups were deleted. Files are encrypted with ChaCha20 and RSA (full or partial) and get the .SafePay extension. Ransom notes point to a Tor chat portal with a victim ID. Demands are typically a portion of company revenue, payable in cryptocurrency.
   • The advisory provides downloadable STIX indicators. Legitimate tools and historical IP addresses need contextual verification before blocking.

   Remediation

   • Prioritize patching of the exploited vulnerabilities on internet-exposed systems.
   • Enforce multifactor authentication, restrict administrative privileges and segment networks.
   • Keep offline, encrypted, immutable backups and regularly test restoration.
   • Hunt for unexpected accounts, remote administration activity, security service changes and unusual outbound transfers.
   • On detection, isolate affected hosts, preserve evidence, scope compromised accounts and coordinate eviction.
5. cisa.gov ↗ · pub. 19/10/2026 16:18 · coletado 20/10 16:00 primeiro registro

   CISA and partners publish #StopRansomware advisory on SafePay ransomware: 600+ victims, VPN and edge-device exploitation

   ler a análise desta fonte ocultar

   A joint #StopRansomware advisory (AA26-293A) from the FBI, CISA, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit details SafePay ransomware activity observed through August 2026. SafePay has been highly active since August 2024 and was among the most active ransomware groups of 2026. It has affected at least 600 victims across critical infrastructure and businesses in North America, South America, Europe and Australia. Initial access comes from stolen or guessed credentials, brute forcing, phishing, and exploitation of known edge-device vulnerabilities. Operations end in double extortion, with data exfiltration, encryption and phone calls to pressure victims.

   Technical Details

   • Initial access: credential exposure, brute force [T1110], phished account profiles used over Mullvad VPN IP addresses, and automated exploitation of internet-exposed systems [T1190]. Listed CVEs: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766.
   • Persistence and privilege escalation: administrative privileges on existing accounts [T1098] or newly created accounts [T1136]; UAC bypass via COM [T1548.002]; token impersonation [T1134.001].
   • Lateral movement and discovery: living-off-the-land binaries such as PsExec and WinRM, plus RDP, remote management software, ShareFinder.ps1 and SharpShares.exe for share enumeration.
   • Defense evasion: security software is disabled, user passwords are changed, code is packed [T1027.002], and the ransomware may delete itself after encryption [T1070.004].
   • Exfiltration: FileZilla, 7-Zip, RClone, WinRAR, WinSCP and OneDrive. AnyDesk and TeamViewer are used to stage tooling.
   • Impact: Volume Shadow Copy Service is halted and NAS backup devices are factory-reset [T1490]. Files are encrypted [T1486] with a hybrid ChaCha20 and RSA scheme and given the .SafePay extension. Ransom is demanded in cryptocurrency, the note points to a TOR chat portal with a victim ID, and stolen data is posted on the SafePay leak site if the victim does not pay.
   • IOCs (IPs, files, hostnames) were observed between November 2024 and August 2026 and are provided as STIX XML/JSON. They are not reproduced in the article text. Some listed files are legitimate tools and should be verified before blocking.

   Remediation

   • Prioritize patching known exploited vulnerabilities, especially on firewalls, VPNs and other edge devices, per CISA Binding Operational Directive 26-04.
   • Enforce ICAM policies and phishing-resistant MFA for webmail, VPNs and critical accounts; use long passwords (15-64 characters) and account lockouts.
   • Keep offline, encrypted, immutable backups and test restoration.
   • Segment networks, deploy EDR and network monitoring, and restrict administrative tools and privileges (least privilege, just-in-time access).
   • Audit Active Directory for new or unrecognized accounts, and restrict command-line and scripting activity.
   • If a compromise is detected, isolate hosts, threat hunt, report to the FBI (or Report Fraud in the UK), and use CISA's Eviction Strategies Tool.