Joint Advisory Names SafePay Among 2026's Most Active Ransomware Groups
The FBI, Germany's cybersecurity agency and law enforcement, and the UK's cybersecurity agency published a joint advisory on SafePay (referenced as AA26-293A). It draws on multiple FBI and German investigations, the most recent covering an incident in August.
Scale
- At least 600 organizations in the US and Europe breached since August 2024
- The leak site lists dozens of German companies and government organizations in Latin America and the US
- Recent claims include a major US IT provider, UK tech company Microlise, and government contractor Conduent, whose attack disrupted services tied to Medicaid, child support, food assistance and road tolls
Tactics
- Initial access: password guessing, exploiting vulnerabilities, and phishing, aided by automated scanning of internet-facing systems
- Persistence and movement: creating or taking over accounts, then using legitimate system tools to find valuable files
- Defense evasion: disabling security protections, and in some cases changing user passwords to lock out defenders
- Exfiltration and deployment: compressing and stealing files with legitimate tools, then deploying ransomware via remote tools such as AnyDesk and TeamViewer
- Extortion: encrypting data and demanding a share of revenue in cryptocurrency, with phone calls to victims for added pressure
Parts of SafePay's code resemble the largely defunct LockBit.
Vulnerabilities Cited
CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, among others. These cover Cisco, Veeam and SonicWall products, so patch status of edge and backup systems deserves a check.
Recommended Actions
- Patch the listed CVEs and other internet-facing systems.
- Enforce phishing-resistant MFA and block password guessing with lockouts.
- Audit for unauthorized remote access tools such as AnyDesk and TeamViewer.
- Keep offline, tested backups.
Read the full advisory AA26-293A for the complete mitigation list.
Source: The Record.