SafePay ransomware: what the CISA/FBI advisory says and how to defend

What the advisory covers

The joint advisory, numbered AA26-293A and published by CISA on October 20, 2026, names the Federal Bureau of Investigation (FBI), CISA, the United States Secret Service (USSS), Germany's Landeskriminalamt Rheinland-Pfalz, the United Kingdom's National Crime Agency and the United Kingdom's North West Regional Organised Crime Unit as its authors. It says that SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe and Australia.

The advisory also gives a victim count, which shows how widely the group has operated.

The rest of this guide follows the order of the attack: entry, movement, theft and extortion. It then covers the mitigations the agencies ask organizations to apply.

How SafePay gets in

The advisory describes several routes into a network, and none of them is exotic. According to CISA's summary, the group relies on stolen or guessed credentials, flaws in security products and phishing.

The technical section is more specific about how phished access is used. It says the actors connect from IP addresses of the VPN provider Mullvad, and that they use phished account profiles against edge devices carrying CVE-2020-3259 and CVE-2023-20269.

The advisory names three further vulnerabilities that the agencies saw exploited at scale: CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. It says the actors went after internet-exposed systems using automated scripts.

How it moves through the network

Once inside, the group does not depend on custom malware to spread. The advisory says the actors first make sure they can return, either by taking over existing accounts or by creating new ones. ]

From there, the advisory says they run commands on other machines with tools that already exist in the environment.

To find what is worth stealing, the advisory says the actors used a PowerShell script that maps file shares. It also lists SharpShares.exe, which does the same job.

Before they spread further, the advisory says they turn off the tools that would catch them.

The advisory also lists Mimikatz, a credential dumper, and Remote Desktop Protocol among the tools and methods used. It describes UAC bypass and token impersonation as the privilege escalation techniques observed.

How it steals, encrypts and extorts

SafePay takes the data before it locks anything. The advisory lists FileZilla, 7-Zip, RClone and WinRAR for collecting and compressing files. It says the data is then sent out to accounts the actors control.

The advisory says the group also works to remove the victim's way back.

Encryption follows. The advisory states that files carry the .SafePay extension and that no recovery path exists without the actors' key.

The ransom demand is tied to the size of the victim. The advisory says the actors ask for payment in cryptocurrency, and that the amount is based on company revenue.

The ransom note points victims to a chat portal on a TOR .onion site, where the victim ID serves as the login. The advisory says the pressure does not stop at the note.

The order of these steps matters for defenders. Data theft happens first, so restoring from backup does not remove the leak threat.

Mitigations to prioritize

The advisory sets out a long list of mitigations. The press release dated October 21, 2026 gives a shorter version, and the advisory itself puts patching first.

Patch internet-facing systems and check for compromise. CISA's Acting Executive Assistant Director for Cybersecurity, Chris Butera, said in the press release that CISA encourages organizations to focus on

Require multifactor authentication. Because entry often comes through stolen credentials and VPNs, the advisory sets a broad MFA requirement. It says to

The advisory adds password guidance. It asks for passwords of at least 15 characters, account lockouts after repeated failed logins, and no forced password changes more often than once per year. It also tells organizations to audit administrative accounts and apply least privilege, and it describes just-in-time access for admin-level accounts.

Protect backups. Since the group goes after backups, the advisory's backup standard is strict. It says to organization's data infrastructure. It also calls for offline copies and regular restoration tests.

Segment the network. The advisory ties segmentation to the movement techniques described above.

The advisory also recommends network monitoring, with endpoint detection and response (EDR) tools singled out for spotting lateral connections. It further recommends reviewing domain controllers, servers and workstations for new or unrecognized accounts, and disabling command-line and scripting activity that is not needed. It describes these steps as measures that make privilege escalation and lateral movement harder.

If you find an intrusion, and reporting

For a compromise caught before encryption, the first step in the advisory's incident response list is containment.

The advisory then calls for threat hunting to scope the intrusion, and for eviction countermeasures once enough hunting data is collected. It points to CISA's Eviction Strategies Tool for building a plan. If files are already encrypted, it directs readers to the checklist in CISA's #StopRansomware Guide.

On payment, the agencies take a clear position.

The advisory asks victims to report incidents promptly to the FBI's Internet Crime Complaint Center, a local FBI or USSS field office, or CISA, whether or not they pay. It also lists indicators of compromise in STIX XML and JSON files. It warns that the listed IP addresses may later be reassigned to benign services, so they should be checked against current telemetry before blocking.