By Hamza Faisal

One of the world's most active ransomware gangs has quietly become one of its most destructive. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that the SafePay ransomware group has breached more than 600 critical infrastructure organizations across North America, South America, Europe and Australia since August 2024 — and that the group deliberately sabotages victims' backups before demanding payment.

The warning came in a joint advisory published October 20, 2026, co-authored with the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and the U.K.'s National Crime Agency and North West Regional Organised Crime Unit. It draws on investigative findings collected through August 2026.

How SafePay gets in

According to the advisory, SafePay operators gain initial access through exposed or phished credentials, brute-force password attacks and by exploiting VPN access — notably IP addresses of the privacy-focused VPN provider Mullvad. The agencies stressed that Mullvad itself was not compromised; its addresses simply showed up in intrusion activity.

The group also uses compromised account profiles and automated exploitation scripts against internet-facing systems. Investigators listed five exploited vulnerabilities, including CVE-2020-3259, CVE-2023-20269 and CVE-2023-27532 in edge devices, plus CVE-2024-40711 — a critical 9.8-rated flaw in Veeam Backup & Replication that allows unauthenticated remote code execution — and CVE-2024-40766 affecting SonicWall firewalls.

First the backups, then the files

SafePay's signature cruelty is its war on recovery. Once inside a network, the attackers stop the Volume Shadow Copy Service and, in observed cases, reset network-attached storage devices holding backups to factory settings — leaving victims with nowhere to restore from.

The group runs a classic double-extortion playbook: steal sensitive data first, then encrypt systems with a combination of ChaCha20 and RSA encryption, appending ".SafePay" to files, and threaten to publish the stolen data on a dark web leak site if the cryptocurrency ransom isn't paid. SafePay emerged in August 2024 as a private operation with no affiliates — a setup that helped it rise fast as older giants like BlackCat (ALPHV) and LockBit declined.

What defenders should do

The agencies urged network defenders to restrict administrative tools and privileges to block lateral movement, enforce multifactor authentication, and keep systems updated — with priority on VPNs, firewalls and other edge devices added to CISA's actively-exploited catalog. They also emphasized maintaining tested offline, immutable backups that attackers can't reach or reset.

CISA added a familiar warning: paying the ransom does not guarantee files will be recovered, and victims should report incidents to law enforcement instead.

By Hamza Faisal