What SafePay Ransomware Exposes About Asset Inventory and Backups

Most mid-market companies cannot name every firewall, remote access tool, and backup server on their network. When SafePay hits, that blind spot turns a patchable flaw into a full shutdown and a ransom demand pegged to revenue.

Why Asset Inventory Is the First Risk Check

When a ransomware warning lands, we first ask whether the company can produce a current hardware and software inventory. Without one, leadership and IT are guessing at what faces the internet.

SafePay makes that guess expensive. Since August 2024, it has hit more than 600 victims across North America, South America, Europe, and Australia, making it one of the most active ransomware groups of 2026.

On October 20, 2026, the FBI, CISA, and international partners issued Joint Cybersecurity Advisory AA26-293A. It found that SafePay rarely bothers with zero-day exploits, leaning instead on exposed credentials and forgotten edge appliances.

How SafePay Breaks Into Networks

SafePay gets in through stolen, exposed, or guessed passwords, phishing emails, and compromised VPN logins. Operators often connect through Mullvad VPN addresses to look ordinary.

The advisory also lists five flaws from CISA’s Known Exploited Vulnerabilities (KEV) catalog of bugs used in real attacks:

• Cisco ASA and Firepower Threat Defense: CVE-2020-3259 and CVE-2023-20269
• SonicWall SonicOS: CVE-2024-40766
• Veeam Backup & Replication: CVE-2023-27532 and CVE-2024-40711

CISA added a separate SonicOS flaw, CVE-2026-19868, to the catalog on November 6, 2026. It is not on the advisory’s list, but SonicWall shops should patch it just as fast.

Several of the advisory’s five flaws have had patches since 2020 or 2023. They stay open when nobody tracks every firewall and backup server.

How SafePay Moves After Initial Access

Once inside, operators hijack existing admin accounts or create new ones that pass for IT staff. They move between machines with PsExec, WinRM, and Remote Desktop Protocol (RDP), plus AnyDesk, TeamViewer, and ScreenConnect.

Monitoring often skips those tools because they are approved software. SafePay then disables security software and steals files with RClone, WinSCP, FileZilla, OneDrive, or Backblaze.

Ransom demands are set as a percentage of revenue and paid in cryptocurrency. Operators then phone company leaders and threaten to post stolen files on a leak site.

Why Backup Management Fails Under Pressure

Most owners assume their managed service provider (MSP) or internal IT team has backups handled. In our experience, backups are what both neglect most. Restoration tests get skipped, and no copy sits offsite or in immutable storage.

Before encrypting production systems, SafePay operators stop Windows Volume Shadow Copy, which wipes out local restore points. They also factory-reset the network storage that holds backup files.

If your backup server runs unpatched Veeam or shares admin credentials with production, attackers can erase your recovery path in minutes. Even a solid ransomware recovery playbook fails if backups sit reachable from the main network.

Ownership is the other gap. Leadership assumes the MSP owns backup design, and the MSP assumes leadership set the risk tolerance. Knowing how a fractional CIO and an MSP serve different roles helps leadership name one owner for recovery.

What Business Owners Should Check This Week

Leadership should send two written requests this week instead of waiting for the annual audit.

First, ask your internal IT lead or MSP for a current hardware and software inventory covering edge firewalls, remote access tools, and backup servers. Have them confirm that the Cisco, SonicWall, and Veeam flaws above are patched, verify VPN accounts require multi-factor authentication, and review recent login activity. If that inventory takes more than a few days, building it comes first.

Second, ask whoever owns business continuity and disaster recovery (BC/DR) to confirm what the plan covers, where it lives during an outage, and who runs it. They should also state what it assumes about risk appetite. Then they should ask the MSP or backup provider when the last full restore test ran and whether one clean copy sits offsite and immutable.

If you want an independent check of your asset inventory, backup controls, or recovery readiness, schedule a conversation with our team.

Sources

• Joint Cybersecurity Advisory AA26-293A: #StopRansomware: SafePay Ransomware (October 20, 2026)
• CISA, FBI, and Partners Warn Organizations of SafePay Ransomware Actors (October 21, 2026)
• CISA Known Exploited Vulnerabilities (KEV) Catalog
• StopRansomware.gov

Frequently Asked Questions

What is the October 2026 SafePay advisory?

Joint Cybersecurity Advisory AA26-293A, titled #StopRansomware: SafePay Ransomware, was published on October 20, 2026. The authors are the FBI, CISA, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency, and the UK's North West Regional Organised Crime Unit. CISA's press release is dated October 21, 2026. The advisory describes a group active since August 2024, with at least 600 victims across North America, South America, Europe, and Australia, and places it among the most active ransomware groups in 2026.

Why does SafePay matter to a manufacturer or distributor?

The advisory ties entry to stolen, exposed, or guessed passwords, phishing, and VPN access, often from Mullvad VPN addresses, and to five older flaws in Cisco ASA and Firepower firewalls, Veeam Backup & Replication, and SonicWall SonicOS. Those products sit at the edge of many plant and warehouse networks and on the systems that hold backups.

Which vulnerabilities should we ask IT to prove are patched?

Ask for proof on CVE-2020-3259 and CVE-2023-20269 for Cisco ASA and Firepower Threat Defense, CVE-2023-27532 and CVE-2024-40711 for Veeam Backup & Replication, and CVE-2024-40766 for SonicWall SonicOS. All five are in CISA's Known Exploited Vulnerabilities catalog, added between August 2023 and October 2024, and flagged as used in ransomware. Also ask about SonicWall SonicOS SSL VPN flaw CVE-2026-19868, which CISA added to that catalog on November 6, 2026.

What should we ask about backups after this advisory?

Ask whether at least one backup copy cannot be reached or wiped from the company network, and ask for the date of the last restore a person actually checked. The advisory describes attackers stopping Volume Shadow Copy and factory-resetting network storage that holds backups.

Should our MSP answer these questions, or should leadership?

Whoever operates the firewalls, the VPN, and the backups should answer in writing, with a version, a date, and the device when a patch is claimed. If that operator is a managed IT provider, the company still owns the questions and the decision about any gap the reply reveals.