A joint advisory from American, German and British agencies warns that SafePay ransomware has affected at least 600 organisations since August 2024. Advisory AA26-293A, released on 20 October 2026, was issued by the FBI, the US Cybersecurity and Infrastructure Security Agency (CISA) and the US Secret Service, with Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit. The agencies describe SafePay as among the most active ransomware groups of 2026, with victims across critical infrastructure and business in North America, South America, Europe and Australia.

How SafePay breaks in and blocks recovery

According to the advisory, SafePay enters through exposed or brute-forced credentials, phished VPN accounts routed through Mullvad VPN addresses, and automated exploitation of five known flaws in internet-facing devices affecting Cisco ASA, Veeam Backup and Replication and SonicWall SonicOS equipment. Once inside, the attackers use legitimate tools such as PsExec, Windows Remote Management and Remote Desktop Protocol to move across networks, steal credentials and copy data out before encrypting files with ChaCha20 and RSA encryption. The group also attacks recovery itself, deleting shadow copies, stopping backup processes and factory-resetting network storage devices, and sometimes telephoning victims to press them to pay.

What the agencies urge organisations to do

The agencies urge organisations to patch internet-facing edge devices promptly, enforce multi-factor authentication on remote access, restrict administrative tools and privileges, and keep backups offline, encrypted and immutable so one intrusion cannot wipe every copy. The advisory names no individual behind SafePay, and the 600 figure is the agencies' count of organisations impacted, not a claim that every victim suffered both data theft and encryption. For firms still running unpatched Cisco, Veeam or SonicWall edge equipment, the entry points are old, known and fixable.

Sources: CISA advisory AA26-293A, BleepingComputer.