SafePay ransomware has affected at least 600 separate victims across multiple critical infrastructure sectors, according to a joint government advisory released on October 20, 2026.

Active since August 2024, the group has targeted businesses and essential services across North America, South America, Europe, and Australia, becoming one of the most active ransomware threats in 2026.

The attacks combine stolen passwords, exposed remote access services, and known software flaws. After entering a network, attackers take control of accounts, search for valuable files, steal data, and damage recovery systems before encrypting files.

This sequence puts victims under pressure from both business disruption and the threat of stolen information being published online.

Analysts at CISA and partner agencies noted these SafePay activities in the joint SafePay ransomware advisory, which draws on investigations conducted through August 2026.

Contributors include the FBI, United States Secret Service, German investigators, and UK law enforcement. Their findings describe an operation that relies heavily on trusted accounts and common administration tools.

SafePay Ransomware Has Affected 600+ Organizations

SafePay operators gain access through exposed credentials, repeated password guesses, phishing, and vulnerable internet-facing systems. Earlier reporting on SafePay RDP and VPN attacks also documented the group’s use of compromised remote connections.

The latest advisory adds details about automated exploitation and the abuse of phished account profiles to enter victim networks.

The agencies identified exploitation involving CVE-2020-3259 and CVE-2023-20269 in edge devices, alongside CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 across internet-exposed systems.

Attackers also connected through Mullvad VPN addresses. That finding describes the service being used during intrusions; it does not mean Mullvad itself was compromised or that its ordinary users are linked to SafePay.

Backup infrastructure is another important target. CVE-2024-40711 affects Veeam Backup & Replication and allows unauthenticated remote code execution.

Previous Veeam ransomware exploitation cases showed attackers combining compromised VPN access with this flaw to create administrator accounts.

Those earlier incidents involved other ransomware families, highlighting a shared weakness rather than proving a direct connection between the groups.

Trusted Tools Help Attackers Spread

Once inside, SafePay operators create accounts or raise the permissions of existing ones. They use PsExec, Windows Remote Management, and Remote Desktop Protocol to run commands and reach other machines.

Since these tools also support normal IT work, defenders need to examine who launched them, where they ran, and whether their use fits approved activity.

The attackers search shared folders for useful files, disable security software, and sometimes change user passwords, locking legitimate staff out. Investigators also observed methods that bypass Windows User Account Control and reuse security tokens to gain higher access.

Code packing helps hide malicious programs, while remote support applications provide another route for moving software onto compromised systems.

For data theft, SafePay uses familiar tools including 7-Zip, WinRAR, RClone, WinSCP, and FileZilla. Some incidents involved OneDrive or Backblaze storage.

These applications are not automatically malicious: the warning signs are their unexpected deployment, unusual data transfers, and connections to accounts outside the organization’s control, particularly when combined with other signs of compromise.

The group’s focus on recovery makes its attacks especially disruptive. Operators stop the Volume Shadow Copy Service and have reset network-attached storage holding backups to factory settings.

Related reporting on SonicWall access control flaws shows why securing remote access matters before attackers can reach internal systems and backup resources.

After stealing data, SafePay encrypts files using ChaCha20 together with RSA. The ransomware can encrypt whole files or selected portions depending on file type and size.

Victims receive a ransom note directing them to a Tor chat portal, while phone calls and threats to publish stolen data add pressure. The malware may delete itself afterward.

CISA and its partners urge organizations to patch exposed systems, require multifactor authentication, and limit administrator rights. Backup copies should remain offline or protected against changes and deletion, with restoration tested regularly.

Separating networks can also restrict the path from a compromised remote access account to servers holding sensitive files and recovery data.

Security teams should review unfamiliar accounts, unexpected remote tools, disabled protections, and unusual outbound transfers together rather than treating each event in isolation.

If an intrusion is suspected, the agencies recommend isolating affected machines, preserving logs, and investigating its scope. They discourage ransom payments because payment does not guarantee file recovery and can support further criminal activity.

Indicators of compromise (IoCs):-

IP Addresses

IP address	Reported association
`104.26.2[.]223`	SafePay victim intrusion
`140.82.114[.]4`	SafePay victim intrusion
`185.199.108[.]133`	SafePay victim intrusion
`77.37.49[.]40`	SafePay victim intrusion
`173.194.194[.]94`	Hosting victim data
`167.235.225[.]149`	Client login panels
`5.255.11[.]134`	Data exfiltration
`88.119.167[.]239`	`soc.dll` command and control
`37.10.71[.]188`	Data exfiltration

Source: CISA advisory, Table 2.

SHA-1 Hashes

File or description	SHA-1
`1.exe` — ransomware binary	`07353237350c35d6dc2c8f143b649cd07c71f62b`
`Locker.dll` — PE32 executable	`b498a2683640c983bb069fa2ea9e67cef4a3797d`
`locker.dll`	`BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081`
`nxc`	`d711a5af5aed48a3b36b98f4fcf52809aebef7a2`

Source: CISA advisory, Table 4.

SHA-256 Hashes

File or description	SHA-256
`soc.dll`	`921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae`
RunPE bundled DLL	`6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a`
Injected PE	`e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346`
`locker.dll` — PE32 executable	`327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917`
`locker.dll`	`a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526`
`SharpShares.exe`	`BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41`

Source: CISA advisory, Table 5.

Filenames and File Patterns

Filename or pattern	Context reported in the advisory
`1 - Copy.bat`	Script likely used to copy, stage, or move files
`CCleaner.exe` / `CCleaner64.exe`	Legitimate cleanup tools; investigate unexpected enterprise deployment
`CCleaner.exe` / `.dll`	Possible abuse or impersonation of CCleaner components
`dcsync.exe`	Active Directory credential extraction
`domains.txt`	Likely output containing domain information
`DYRasWtb.exe`	Suspected malicious executable
`libsmb2.dll`	SMB library that may support file transfer or network movement
`Libwa*.dll`	Suspicious libraries requiring further analysis
`License.txt`	Benign filename observed with “S.P_Network Scanner”
`locker.dll`	Potential ransomware or encryption component
`netscan.exe`	Network discovery and scanning
`netscan.lic` / `netscan.xml`	Network scanning configuration or output
`netscanNEW.zip`	Archive potentially used to stage scanning tools
`nltest.exe`	Legitimate Windows domain tool; investigate use outside approved workflows
`oui.txt`	MAC address vendor lookup output
`ping.txt`	Network connectivity testing output
`portable.dat`	Possible configuration or staging file
`scan.xml`	Scanning or discovery output
`sharefinder.ps1`	Network share discovery script
`Socks.exe`	SOCKS proxy tool for tunneling traffic
`Socks_werfault.exe`	Binary likely disguised as a Windows-related process
`subs.txt`	Possible staging file or target list
`svchost.exe`	Legitimate Windows process; investigate unusual paths or impersonation
`wa_3rd_party_host_*.exe`	Suspicious binaries or disguised components
`winrar.exe`	Legitimate archiving tool used for data staging
`AnyDesk.exe`	Legitimate remote desktop tool abused to transfer malware
`SharpShares.exe`	Network share discovery
`AcronisDiskDirector-12.5` / `acro.exe` / `DiskDirector.exe` / `Acronis.exe`	Legitimate disk management software
`b2.exe`	Backblaze B2 command-line tool used for data theft
`nxc.exe`	NetExec tool for system discovery, credential checks, and remote operations

Source: CISA advisory, Table 3. These names require supporting evidence before being classified as malicious.

Hostnames and Encryption Marker

Type	Indicator
Hostname	`WIN-SBOE3CPNAL`
Hostname	`WIN-3IUUOFVTQAR`
Hostname	`WIN-DK18BI83M0S`
Hostname	`WIN-I1HRRJHCEIV`
Encrypted-file extension	`.SafePay`

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers appeared first on Cyber Security News.