FBI, U.K. and German Agencies Say SafePay Ransomware Has Hit at Least 600 Victims Through Edge VPN Flaws and Stolen Logins, Then Uses PsExec, WinRM and RClone and Factory-Resets Backup Storage

LONDON - The FBI and partner agencies in the United States, Germany and Britain said on Tuesday that the SafePay ransomware group has hit at least 600 organizations since August 2024, typically by stealing or guessing passwords, exploiting flaws in edge security devices and phishing, and then working with ordinary administration tools until the moment it encrypts.

The joint advisory, AA26-293A, was published on Oct. 20 by the FBI, the Cybersecurity and Infrastructure Security Agency, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the United Kingdom's National Crime Agency and the North West Regional Organised Crime Unit. It draws on FBI, Secret Service and Rheinland-Pfalz investigations as recent as August 2026, and it describes SafePay as among the most active ransomware groups of 2026, with victims across North America, South America, Europe and Australia. "The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors," the agencies wrote.

The way in

The agencies said SafePay actors obtain initial access through exposed credentials, brute-force password attacks and VPN access, connecting from IP addresses of the VPN provider Mullvad and using phished account profiles to exploit CVE-2020-3259 and CVE-2023-20269. Public CVE records tie both of those flaws to Cisco's Adaptive Security Appliance and Firepower Threat Defense software. The actors also used automated scripts to exploit CVE-2023-27532 and CVE-2024-40711, which the records tie to Veeam Backup & Replication, and CVE-2024-40766, a SonicWall SonicOS access control flaw.

None of the five is new. For a detection team, that is the point: the group's entry list is a patch backlog and a set of VPN and backup consoles that should already be generating authentication telemetry.

Living off the land, then cutting off recovery

Once inside, the advisory said, SafePay actors gain administrative privileges on existing accounts or create new ones, then use PsExec and Windows Remote Management to run commands on remote systems. In several cases they ran ShareFinder.ps1, a PowerShell function that enumerates network file shares in Active Directory, and SharpShares.exe to find data worth stealing. They escalated with a User Account Control bypass and token impersonation, moved laterally over RDP and remote monitoring and management software, disabled security tools and, in some cases, changed the passwords of system users so that valid logins stopped working.

For collection and theft, the group used FileZilla, 7-Zip, RClone and WinRAR to compress data, WinSCP and RClone to move it out, OneDrive in some cases, and b2.exe to send victim data to Backblaze B2 storage. It installed AnyDesk or TeamViewer to bring in ransomware and other software, and the tool list also includes Mimikatz, ScreenConnect, NetExec and Acronis Disk Director. To block recovery, the agencies said, the actors halt the Volume Shadow Copy Service and reset network attached storage that holds backups to factory settings.

The encryptor combines a ChaCha20 stream cipher with RSA, supports full or partial encryption depending on file type and size, and appends .SafePay to locked files. The ransom note, usually on the desktop or in the root directory, points victims to a Tor chat portal that uses a victim ID as the login. A representative then calls victims on the group's behalf to apply pressure, and unpaid victims' data goes to the SafePay leak site. The agencies said the ransomware may delete itself after encryption.

The indicators, with a caveat

The advisory lists nine IP addresses, 30 file entries, SHA-1 and SHA-256 hashes for files including locker.dll and a soc.dll component tied to command-and-control traffic at 88.119.167[.]239, and four attacker hostnames: WIN-SBOE3CPNAL, WIN-3IUUOFVTQAR, WIN-DK18BI83M0S and WIN-I1HRRJHCEIV. File names worth hunting include dcsync.exe, Socks.exe, Socks_werfault.exe, netscan.exe, nxc.exe and b2.exe. The indicators were observed between November 2024 and August 2026.

The agencies told defenders to verify the addresses before blocking them, noting that infrastructure on cloud or virtualized platforms can be reassigned and that the indicators "should be interpreted as historically observed infrastructure within the activity window." Several of the tools are legitimate software, and the advisory said they should not be treated as malicious without evidence of actor use.

What detection teams should hunt

• Authentication to Cisco ASA or Firepower VPNs, SonicWall appliances and Veeam consoles from Mullvad exit addresses, and brute-force patterns against those services.
• New local or domain accounts, or new administrative group membership, shortly after a VPN login from an unfamiliar source.
• PsExec service creation and WinRM sessions fanning out from a single host, alongside ShareFinder.ps1, SharpShares.exe, netscan.exe or nxc.exe execution.
• Security tooling being disabled, and password changes on system accounts that lock out legitimate administrators.
• RClone, WinSCP, FileZilla or b2.exe transfers, large 7-Zip or WinRAR archives, and unexpected OneDrive uploads from servers.
• Volume Shadow Copy Service being stopped and any factory reset of backup NAS devices, which the agencies list as recovery inhibition.
• Files with the .SafePay extension, hostnames such as WIN-SBOE3CPNAL in authentication logs, and the published hashes.

The agencies also urged MFA for webmail, VPNs and critical systems, passwords of at least 15 characters, offline encrypted and immutable backups, network segmentation, just-in-time administrative access, and the CISA Eviction Strategies Tool for planning containment after a compromise.