AA26-293A: FBI, CISA and German and UK law enforcement describe SafePay ransomware, which enters through VPN credentials and five edge-device and backup-server flaws and factory-resets backup NAS devices before encrypting

CISA, the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and UK law enforcement published advisory AA26-293A on 2026-10-20, drawing on investigations as recently as August 2026; they say SafePay has affected businesses and critical infrastructure in North America, South America, Europe and Australia since August 2024, was among the most active ransomware groups in 2026 and has impacted at least 600 separate victims (CISA et al., 2026-10-20). Initial access is exposed credentials, brute force password attacks and VPN access, with the actors using Mullvad VPN addresses and phished account profiles to reach victim networks and exploit CVE-2020-3259 and CVE-2023-20269 on edge devices, and automated scripts exploiting CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 on internet-exposed systems (CISA et al., 2026-10-20). CISA's catalog names them as Cisco ASA and Firepower Threat Defense (the first two), Veeam Backup & Replication (the next two) and SonicWall SonicOS flaws (CISA KEV catalog, 2026-10-20).

Once inside, the actors take administrative rights on existing accounts or create new ones, run commands remotely with PsExec and WinRM, enumerate network shares with ShareFinder.ps1 and SharpShares.exe, disable security software, bypass User Account Control, then move over RDP and remote-management tools (CISA et al., 2026-10-20). They compress data with 7-Zip or WinRAR and exfiltrate it with WinSCP, RClone, FileZilla or OneDrive, and sometimes install AnyDesk or TeamViewer (CISA et al., 2026-10-20). Before encrypting they halt the Volume Shadow Copy Service and reset network-attached storage that holds backup data to factory settings; encryption then appends .SafePay (CISA et al., 2026-10-20).

Triage: 7-Zip, WinRAR, RClone, FileZilla, AnyDesk, TeamViewer, PsExec and WinRM are everyday administrative tools, and the advisory warns against calling them malicious without evidence of actor use (CISA et al., 2026-10-20); a shadow-copy service stop or a factory reset of backup storage that follows them is the discriminating step.