In short: On 20 Oct 2026 six authorities published a joint warning about the extortion group SafePay, among them the FBI, the US agency CISA and the State Criminal Police Office of Rhineland-Palatinate (LKA). According to the warning, SafePay has attacked at least 600 organisations since August 2024. The group usually gets in through stolen passwords and unpatched VPN access and destroys backups on purpose before encrypting. The group has also been very active in Germany since 2025. As of 30 Oct 2026.
What the authorities report
The warning carries the ID AA26-293A. It was issued by the FBI, CISA, the US Secret Service, the LKA Rhineland-Palatinate and, from the UK, the National Crime Agency and the North West Regional Organised Crime Unit. The findings come from investigations up to August 2026. Victims are in North and South America, Europe and Australia, across several critical infrastructure sectors.
SafePay is a ransomware group. Ransomware is malware that encrypts data and only releases it against a ransom. According to Cybernews, SafePay claimed attacks on 76 German companies in 2025, about a quarter of all German victims on leak sites that year (it-daily, 26 Oct 2026). A leak site is a darknet page where criminals name victims and publish stolen data. Such entries are claims by the attackers and are not always confirmed.
How SafePay gets in
According to the warning, the group uses stolen or guessed passwords, phishing and internet-facing systems such as VPN gateways and firewalls. A VPN is an encrypted remote access into the company network. SafePay does not use zero-day flaws. All five vulnerabilities named have been known since 2024 or earlier and have updates:
- Cisco ASA and FTD (firewalls and VPN): CVE-2020-3259 and CVE-2023-20269
- SonicWall SSL VPN: CVE-2024-40766
- Veeam Backup & Replication (backup software): CVE-2023-27532 and CVE-2024-40711
Investigators observed connections via the Mullvad VPN service, which attackers use to hide their origin (it-daily).
What happens inside the network
Inside the network the attackers use tools that administrators also use: PsExec, Windows Remote Management and Remote Desktop. That makes them hard to tell apart from normal maintenance. With Mimikatz they read passwords from memory. With ShareFinder.ps1 and SharpShares.exe they look for network shares holding valuable data.
The data is packed with 7-Zip or WinRAR and pulled out via Rclone, FileZilla or OneDrive. Only then does SafePay encrypt the systems. This is double extortion: whoever does not pay faces both downtime and publication of their data. According to the warning, victims who do not respond are also called by phone.
Why backups are the real target
A good backup is the main reason not to pay a ransom. That is why SafePay attacks it directly. According to the warning, the attackers stop the Windows shadow copy service and delete the copies. Shadow copies are automatic snapshots that let Windows restore older file versions. Network storage devices (NAS) holding backups are reset to factory settings, which wipes their content. Backup software is stopped before encryption. Two of the five exploited flaws affect Veeam's backup software itself.
Anyone who keeps backups only in the same network, reachable with the same admin accounts, loses them together with production data when it counts.
What companies can do now
- Close the five flaws. Bring Cisco ASA and FTD, SonicWall firewalls and Veeam Backup & Replication up to date. For Veeam, version 12.1.2.172 or later closes CVE-2024-40711 according to Decryption Digest.
- Remote access only with a second factor. Every VPN and remote access needs multi-factor authentication (MFA), meaning a second proof besides the password, for example via an app. Stolen passwords alone are then not enough.
- Separate backups. Keep at least one copy offline or immutable. Immutable means the backup cannot be deleted or overwritten for a set period, not even with admin rights. The backup environment gets its own accounts, separate from the rest of the network.
- Practise restoring. A backup only counts once the restore has been tested. Once a quarter, restore an important system as a test and measure how long it takes.
- Monitor admin tools. Allow PsExec, WinRM and Remote Desktop only from approved machines. Deleting shadow copies and large data transfers should trigger an alert immediately. The warning lists indicators (IP addresses and file names) you can feed into your own monitoring.
- Keep an incident plan ready. Who calls whom, who may take systems offline, where are the police contact details. Entities under the German NIS 2 Implementation Act must send an early warning of significant incidents to the BSI within 24 hours. If personal data is affected, Art. 33 GDPR sets a 72-hour deadline for notifying the data protection authority.
How GermanAI Defense supports you
Our Cybersecurity Services address exactly these points: checking VPN, firewalls and backup environment for known flaws, a penetration test from an attacker's point of view and round-the-clock SOC monitoring, service and response times as per contract. In an emergency our incident response and forensics team helps with containment and investigation.
→ More about our Cybersecurity Services: View Cybersecurity Services
More current cases: Patch Tuesday October 2026, Binance theft and PHP2Shell
Sources: CISA, FBI, USSS, LKA Rhineland-Palatinate, NCA, NWROCU: #StopRansomware: SafePay Ransomware (AA26-293A), 20 Oct 2026 · it-daily, 26 Oct 2026 · HSToday, October 2026 · Decryption Digest, 21 Oct 2026 · Hagel IT, October 2026