// AI threat desk · 21 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighRANSOMCVSS not assigned

SafePay ransomware advisory details activity affecting at least 600 victims

CISA and partner agencies said SafePay affected at least 600 victims and identified activity through August 2026. CISA published the advisory on Oct 20, 2026.

· 2 min read
AI-generated image of analysts reviewing blurred ransomware incident dashboards in a cybersecurity operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • CISA and partner agencies identified SafePay activity as recently as August 2026.
  • SafePay affected at least 600 separate victims from multiple critical infrastructure sectors.
  • The actors typically gain access by stealing or guessing passwords, exploiting vulnerabilities, and using phishing.

CISA and partner agencies published an advisory on Oct 20, 2026, describing SafePay ransomware activity identified through August 2026. The authoring agencies said their investigations found the activity as recently as August.

SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. CISA said the operation affected at least 600 separate victims from multiple critical infrastructure sectors.

The actors typically gain network access by stealing or guessing passwords, exploiting security-system vulnerabilities, or using phishing tactics. They can then create or take over accounts, move through networks with legitimate tools, identify valuable files, disable protections, encrypt files, and demand cryptocurrency.

On this page

SafePay used phished accounts and automated scripts to enter networks

CISA said SafePay actors used Mullvad VPN provider IP addresses and phished account profiles to access victim networks to exploit known CVEs for edge device products.

Across internet-exposed systems, the actors used automated scripts to exploit CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 for initial access.

In several instances, the actors used ShareFinder.ps1 and SharpShares.exe to identify network file shares and valuable assets.

SafePay used legitimate tools to collect data and block recovery

CISA said SafePay used FileZilla, 7-Zip, RClone, and WinRAR to compress and collect data. WinSCP and RClone helped move data to actor-controlled accounts, while OneDrive was used in some instances for exfiltration.

The actors installed AnyDesk or TeamViewer on some victim systems to transfer ransomware and other software. They also halted the Volume Shadow Copy Service and reset network-attached storage containing backup data to factory settings to inhibit recovery.

SafePay combines ChaCha20 encryption with an RSA public-key cryptosystem, and encrypted files receive the .SafePay extension. CISA said the files cannot be recovered without the decryption key, while the actors typically demand a portion of company revenue in cryptocurrency for decryption software.

CISA said organizations should regularly patch and update systems, especially firewalls and other edge devices. It also called for Zero Trust, limits on administrative tools and privileges, and stronger account security through identity, credential, and access management policies and multifactor authentication.

The authoring agencies said their investigations identified known SafePay ransomware tactics, techniques, procedures, and indicators of compromise as recently as August 2026. CISA said SafePay was among the most active ransomware groups in 2026.

What to do now

  1. Regularly patch and update systems, especially firewalls and other edge devices.
  2. Implement Zero Trust Principle.
  3. Restrict administrative tools and privileges to necessary users only.
  4. Strengthen account security by implementing identity, credential, and access management policies and multifactor authentication.

FAQ

What happened in the SafePay ransomware campaign?

CISA and partner agencies published an advisory describing SafePay activity identified through August 2026. SafePay encrypts victims’ files and leaves ransom notes demanding payment in cryptocurrency.

Who was affected by SafePay ransomware?

SafePay targeted businesses and critical infrastructure across North America, South America, Europe, and Australia. CISA said at least 600 separate victims were affected.

What vulnerabilities did SafePay exploit?

The advisory named CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.

How can organizations protect against SafePay?

CISA said organizations should patch and update systems, especially firewalls and other edge devices, implement Zero Trust, restrict administrative tools and privileges, and use identity, credential, and access management policies with multifactor authentication.

What happens to files encrypted by SafePay?

SafePay appends .SafePay to encrypted files and uses ChaCha20 with RSA. CISA said the files cannot be recovered without the decryption key.

Sources

  1. #StopRansomware: SafePay Ransomware | CISA, CISAPrimary
  2. SafePay, HalcyonPrimary
  3. FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024, The Record
  4. Unmasking the SafePay Ransomware Group, Infosecurity Magazine
How we checked this story
ClaimSourceStatus
CISA said SafePay actors have been highly active since August 2024 and targeted businesses and critical infrastructure across four regions.CISAConfirmed
CISA said SafePay actors typically gain network access by stealing or guessing passwords, exploiting security-system vulnerabilities, and using phishing tactics.CISAConfirmed
CISA said SafePay actors create or take over accounts, use legitimate tools to move through networks, identify valuable files, and disable protections.CISAConfirmed
CISA said SafePay encrypts victims’ files and leaves ransom notes demanding cryptocurrency payments.CISAConfirmed
The authoring agencies said their investigations identified SafePay activity as recently as August 2026.CISAConfirmed
CISA said SafePay was among the most active ransomware groups in 2026 and affected at least 600 separate victims.CISAConfirmed
CISA said SafePay exploited CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 across internet-exposed systems using automated scripts.CISAConfirmed
CISA said SafePay used FileZilla, 7-Zip, RClone, WinRAR, WinSCP, and OneDrive to collect and exfiltrate data.CISAConfirmed
CISA said SafePay used AnyDesk and TeamViewer to transfer ransomware and other software to victim systems.CISAConfirmed
CISA said SafePay halted Volume Shadow Copy Service and reset network-attached storage to inhibit recovery.CISAConfirmed
CISA said SafePay uses ChaCha20 and RSA encryption and appends .SafePay to encrypted files.CISAConfirmed
CISA said SafePay typically demands a subset of company revenue in cryptocurrency for decryption software.CISAConfirmed
The Record reported that SafePay breached at least 600 organizations across the United States and Europe since August 2024.The RecordAttributed
The Record reported that the FBI and German and U.K. agencies called SafePay among the most active ransomware groups in 2026.U.K., via The RecordAttributed
Infosecurity Magazine reported that SafePay claimed 248 victims according to Ransomware.live and RansomFeed.Infosecurity MagazineAttributed
Infosecurity Magazine reported that SafePay’s claimed victims included 96 in the United States, 46 in Germany, and 12 in the United Kingdom.Infosecurity MagazineAttributed
Halcyon said SafePay emerged in September-October 2024 as an independent ransomware operation and used double extortion tactics.HalcyonConfirmed
CISA published its report on Oct 20, 2026.CISAConfirmed

Could not verify

  • Whether SafePay’s 600 victims were all successfully encrypted is not established
  • Whether the listed CVEs were exploited in every affected organization is not established
ransomwarePhishing
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok