A ransomware crew that most people outside incident-response circles have never heard of has quietly put together one of the longest victim lists of the past two years. On October 20, US, German and British law enforcement published a joint advisory on SafePay. It says the group has hit at least 600 separate victims since it appeared in August 2024, and that investigators were still working its intrusions as recently as August 2026.
The advisory, tracked as AA26-293A, is part of CISA's #StopRansomware series. Its authors are the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz (a German state criminal police office), the UK's National Crime Agency and the UK's North West Regional Organised Crime Unit. The advisory says its findings come from FBI, Secret Service and Landeskriminalamt Rheinland-Pfalz investigations.
Who is SafePay?
According to the advisory, SafePay has been active across North America, South America, Europe and Australia, targeting businesses and critical infrastructure from multiple sectors. The authoring agencies say it was among the most active ransomware groups in 2026. Like nearly every modern ransomware operation, it demands payment in cryptocurrency.
The Record, which reported on the advisory the day it came out, added some detail about how the group operates. SafePay reportedly demands "a subset of company revenue in cryptocurrency", so the ransom is set according to how much the victim earns, not as a flat fee. Per the advisory as quoted by The Record, "a representative makes phone calls on behalf of the ransomware group" to put pressure on the victim. A voice on the line is harder to ignore than an email to a shared inbox.
The Record also reported that experts previously said parts of SafePay's code resemble LockBit, a largely defunct ransomware operation that was responsible for hundreds of attacks. A resemblance in code doesn't prove a link between the people behind the two groups, and neither the advisory nor The Record says the two groups are the same.
How do they get in?
None of this is exotic. The advisory says SafePay actors typically gain access by stealing or guessing passwords, exploiting vulnerabilities in security systems, and phishing. In its technical details it cites credential exposure, brute-force password attacks and VPN access as observed routes in.
- Stolen or guessed passwords. The advisory describes credential exposure and brute-force attacks.
- Exploited vulnerabilities in edge devices and other internet-exposed systems, in some cases through automated scripts.
- Phishing.
The advisory names five CVEs (Common Vulnerabilities and Exposures, the standard identifiers for publicly known security flaws) that SafePay has used:
- CVE-2020-3259
- CVE-2023-20269
- CVE-2023-27532
- CVE-2024-40711
- CVE-2024-40766
One of them is CVE-2024-40766. The National Vulnerability Database describes it as an improper access control flaw in the management access of SonicWall's SonicOS. It affects Gen 5 and Gen 6 devices, and Gen 7 devices running SonicOS 7.0.1-5035 and older versions. NVD published it on August 23, 2024, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on September 9, 2024, with a required action to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. KEV entries are binding deadlines for federal civilian agencies and a de facto priority list for everyone else.
The ages of these bugs matter. The oldest carries a 2020 identifier, and the two newest carry 2024 identifiers, which makes the KEV entry for CVE-2024-40766 more than two years old. The advisory describes known, catalogued vulnerabilities in edge device products and internet-exposed systems, not zero-days. That points to unpatched edge devices as the lesson, though the advisory does not say how many victims were breached through each flaw.
Once inside, the advisory and The Record say, the group has installed legitimate remote desktop tools such as AnyDesk and TeamViewer on victim systems and used them to transfer ransomware. These tools are common in IT environments, so their traffic can blend in with normal administrative activity.
Who has been hit?
The advisory itself counts victims, not names. The Record reported that SafePay's leak site, where ransomware groups post victims' names and stolen data to pressure them into paying, currently lists dozens of German companies, along with government organizations across Latin America and the US.
SafePay has also taken credit for attacks on larger names, according to The Record: British tech company Microlise and government technology contractor Conduent. These are claims made by the gang, and this article doesn't treat the attribution as independently verified. The Record said Conduent announced an $80 million settlement the Friday before the advisory came out, in response to a class action lawsuit filed after the ransomware attack.
What It Means for Defenders
Who should care: any organization with internet-facing firewalls, VPNs or other edge appliances, especially in critical infrastructure sectors. The advisory's intended audience includes government, state, local, tribal and territorial entities and critical infrastructure operators. Federal contractors working toward CMMC should note that the controls below align with the access-control, identification-and-authentication and system-integrity requirements they already have to show.
Patch the listed CVEs first. Check your asset inventory against all five identifiers in the advisory: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. For SonicWall devices specifically, NVD lists SonicOS on Gen 5, Gen 6 and Gen 7 up to 7.0.1-5035 as affected by CVE-2024-40766. Apply SonicWall's mitigations as CISA's KEV entry requires. Because SafePay also uses stolen and guessed passwords, treat any edge device that sat unpatched for long as possibly compromised. Patch it, and also rotate its credentials and review its logs.
Enforce MFA everywhere a password can be guessed. The advisory names stealing and guessing passwords as a primary way in, and its key actions include identity, credential and access management policies and multifactor authentication. MFA on VPNs, remote-access portals, email and administrative accounts removes much of the value of a leaked password.
Restrict administrative and remote-access tools. The advisory recommends restricting administrative tools and privileges to necessary users only. Combined with the advisory's account of AnyDesk and TeamViewer use, that means you should know which remote-access software is approved in your environment. Block or alert on anything else, and flag unexpected remote-access sessions on servers.
Move toward zero trust. The authoring agencies recommend implementing zero trust principles, meaning no user or device is trusted just because it's on the internal network. In practice, that means segmenting networks so that one compromised account or appliance can't reach everything.
Prepare for the phone call. Because a SafePay representative reportedly calls victims directly, make sure staff who might answer know to escalate the call to your incident-response lead and not engage. Decide in advance who will contact law enforcement, and who owns that relationship during an incident.
Read the full advisory. AA26-293A contains the agencies' complete list of mitigations and technical details. Read it in full and don't rely on this summary.
