SIX agencies from the US, Germany and the UK issued a joint StopRansomware advisory on SafePay ransomware on 20 October 2026, detailing that the group has compromised at least 600 victims since August 2024. The advisory, AA26-293A, is a collaboration between the FBI, the Secret Service, USSS, Germany’s LKA Rheinland-Pfalz, the UK National Crime Agency (NCA) and the NWROCU.
SafePay targets businesses and critical infrastructure across multiple regions, and investigators say it was among the most active ransomware operations in 2026. The report notes that the operation is attributed to the group as an entity, rather than naming individuals.
SafePay gains initial footholds through weak or stolen credentials, including phished VPN accounts, and then exploits a set of older flaws in edge devices. Specifically, the advisory cites CVE-2020-3259 and CVE-2023-20269 affecting Cisco ASA/Firepower VPN features, and CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 impacting backup servers, firewalls and related infrastructure.
The attackers run automated scans against internet-facing systems, move laterally using living-off-the-land techniques such as PsExec and WinRM, and may disable security tools or reset staff passwords. They exfiltrate data prior to encryption, encrypt files with ChaCha20 and RSA, and publish stolen data if victims resist payment.
The joint guidance emphasises offline, encrypted backups, MFA for VPNs and admin accounts, network segmentation, restricted use of remote tools, and rapid isolation and eviction in case of intrusion. The report also discourages paying ransoms, noting payment does not guarantee recovery.