Rise in SafePay Ransomware Attacks: CISA Issues Warning on Critical Infrastructure Threats
The Cybersecurity and Infrastructure Security Agency (CISA) has raised alarms regarding SafePay ransomware, revealing that this malicious group has successfully infiltrated at least 600 organizations across various sectors of critical infrastructure. This troubling development combines data theft and encryption attacks, specifically targeting backup systems to hinder recovery efforts.
In a detailed advisory released on October 20, 2026, CISA highlighted operations linked to SafePay that have spanned across continents, including North America, South America, Europe, and Australia, since August 2024. The advisory was published in collaboration with the Federal Bureau of Investigation (FBI), the United States Secret Service, and law enforcement agencies from Germany and the United Kingdom. The document encapsulates investigative findings gathered through August 2026, marking a concerted effort among international security agencies to counteract this growing threat.
Investigators have noted that SafePay operators are leveraging specific tactics, such as utilizing Mullvad VPN addresses and employing compromised account profiles, as well as automated exploitation scripts to facilitate their operations. A crucial aspect of the advisory is the identification of five critical vulnerabilities exploited by the attackers: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. Those weaknesses range from information exposure to authentication failures and unsafe deserialization, underscoring the various entry points attackers can exploit.
Among these vulnerabilities, CVE-2024-40711 stands out due to its ability to enable unauthenticated remote code execution via the deserialization of untrusted data, garnering a critical Common Vulnerability Scoring System (CVSS) score of 9.8. Similarly, CVE-2024-40766 poses significant risks as it allows unauthorized access to SonicWall SonicOS management access points, potentially leading to resource compromises and firewall crashes under certain conditions.
Once they gain access, SafePay operators implement measures to maintain persistence within the compromised networks, which often includes creating new accounts or elevating privileges through existing administrative accounts. By exploiting legitimate administrative tools, the attackers can blend their malicious activities into standard enterprise operations, further complicating detection efforts. Command execution and lateral movement are supported through utilities like PsExec, Windows Remote Management, and Remote Desktop Protocol.
Additionally, specialized scripts such as ShareFinder.ps1 and SharpShares.exe serve to map out network shares, allowing attackers to identify and extract valuable information prior to encryption and data exfiltration. According to CISA, SafePay operators often gain access through exposed credentials, phishing schemes, brute-force login attempts, and by targeting internet-accessible vulnerable systems.
The advisory also highlights the methods employed by these ransomware operators for privilege escalation, including User Account Control bypasses and token impersonation tactics. In several cases, they disable security software and even alter user passwords, restricting legitimate access pathways.
Malicious software is often concealed through techniques like software packing and virtual machine protection. Remote access applications such as AnyDesk and TeamViewer are similarly utilized to deploy ransomware and ancillary tools effectively. For data theft, attackers have been observed employing WinSCP, RClone, and sometimes utilizing OneDrive for intrusions.
As a prelude to encryption, attackers create archives with utilities like 7-Zip and WinRAR, subsequently exfiltrating data to cloud services like Backblaze B2 using executable scripts. The implications of their ransomware tactics are particularly dire, as operators often disrupt the Volume Shadow Copy Service and reset network-attached storage devices to factory settings, systematically obliterating backup options before ransom negotiations commence.
The encryption process itself involves the use of ChaCha20 and RSA algorithms, resulting in either full or partial encryption based on file attributes. Compromised files receive the .SafePay extension, with victims directed to a Tor chat portal for ransom communications. The demands generally align with a fraction of a victim organization’s revenue, necessitating payment through cryptocurrency. In a bid to escalate pressure, representatives from the ransomware group may even reach out to victims via phone calls, warning them of the public disclosure of stolen data on the group’s leak site should payment not be fulfilled.
In light of this alarming situation, CISA is urging organizations to prioritize addressing the reported vulnerabilities in their exposed systems and to rigorously enforce measures like multifactor authentication, limiting administrative privileges, and implementing network segmentation. The importance of maintaining offline, encrypted, immutable backups, alongside regularly assessing restoration procedures, cannot be overstated as a strategy for mitigating operational disruptions.
To defend against these threats effectively, organizations are encouraged to investigate anomalies, such as unexpected administrative account activity, unusual outbound data transfers, and alterations in security service settings. The advisory also provides downloadable STIX intelligence and emphasizes the need to contextualize legitimate tools or historical IP addresses before implementing blocklists.
In the event of an intrusion, organizations should take immediate action by isolating compromised hosts, preserving evidence for investigations, scoping out affected accounts, and coordinating necessary remediations. With the persistent evolution of ransomware threats like SafePay, a proactive and informed approach is essential for safeguarding organizational security in an increasingly perilous cyber landscape.