SafePay Ransomware: What the New FBI and CISA Warning Means for Your Business

On October 21, 2026, the FBI, CISA, the U.S. Secret Service and partner agencies in the United Kingdom and Germany published a joint warning about a ransomware group called SafePay. According to the advisory, SafePay has affected at least 600 victims across North America, South America, Europe and Australia since August 2024, and it was among the most active ransomware groups of 2026.

The reason this matters for small and mid-size businesses is how SafePay gets in: through the same firewalls, VPNs and backup servers that most offices rely on every day.

The short version: make sure your firewall, VPN and backup software are fully patched, require multifactor sign-in for remote access, and confirm you have a backup copy that an attacker on your network cannot delete.

How SafePay gets in

The advisory says SafePay typically starts by stealing or guessing passwords, by using phished VPN accounts, and by exploiting known security flaws in internet-facing equipment. It names five specific flaws, all of which have had fixes available for some time and are on CISA's list of vulnerabilities known to be exploited:

• Cisco ASA and Firepower firewalls (FTD): CVE-2020-3259 and CVE-2023-20269
• Veeam Backup & Replication: CVE-2023-27532 and CVE-2024-40711
• SonicWall firewalls (SonicOS): CVE-2024-40766

If your business uses any of these products and has not applied updates in a while, that is the first thing to check.

What happens once they are inside

According to the advisory, SafePay creates or takes over administrator accounts, then moves around the network using ordinary IT tools, such as Windows remote management features and remote access software like AnyDesk, TeamViewer and ScreenConnect. It turns off security software, copies valuable files out of the business, and then encrypts the systems.

Two details stand out for business owners. First, the group goes after backups: it stops Windows shadow copies and has reset network storage devices holding backups to factory settings so the data cannot be restored. Second, if the victim does not pay, the group threatens to publish the stolen files and in some cases phones the business directly to apply pressure.

What to do this week

1. Patch your edge devices. Update firewalls, VPNs and backup servers first, starting with anything reachable from the internet. Check specifically for the five flaws listed above.
2. Turn on multifactor sign-in. The agencies recommend MFA for every service possible, especially VPNs, webmail and accounts that reach important systems.
3. Protect your backups. Keep at least one backup copy offline or immutable (it cannot be changed or deleted), and test that you can actually restore from it.
4. Review admin accounts. Look for new or unrecognized accounts on servers and computers, and limit administrator rights to the people who truly need them.
5. Know what remote access tools you use. If remote access software shows up on a computer and nobody in the business installed it, treat it as a warning sign.
6. Use strong passwords. The advisory recommends long passwords of at least 15 characters and locking accounts after repeated failed sign-in attempts.

Questions to ask your IT provider

1. Are our firewall, VPN and backup software on current versions, and are any of the five flaws in this advisory present?
2. Does every remote sign-in, including the VPN, require multifactor authentication?
3. Do we have a backup copy that someone with admin access on our network could not delete, and when did we last test a restore?
4. Would we notice if a new administrator account or remote access tool appeared on our systems?

Sources

• CISA and partners: #StopRansomware: SafePay Ransomware (AA26-293A)
• CISA: CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors
• CISA: Known Exploited Vulnerabilities Catalog
• StopRansomware.gov