CISA, the FBI and partner agencies say SafePay ransomware has compromised at least 600 organizations since August 2024, across critical infrastructure sectors in North America, South America, Europe and Australia.
The joint advisory, AA26-293A, was published Oct. 20 under the #StopRansomware banner. It states that SafePay was among the most active ransomware groups in 2026. The agencies list stolen, guessed or brute-forced credentials, VPN access including traffic from Mullvad VPN IP addresses, phishing, and exploitation of edge and internet-facing devices as initial access routes. Five CVEs are named for the edge-device route: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
The advisory publishes indicators for defenders: IP addresses, malicious and suspicious files, SHA-1 and SHA-256 hashes, and four WIN-prefixed hostnames, with STIX XML and JSON copies. It notes that some listed tools are legitimate and should be verified before blocking. The agencies do not encourage paying ransom, because payment does not guarantee victim files will be recovered.
The mitigations are ordinary ones. They include patching known exploited vulnerabilities on internet-facing systems first, enforcing MFA on VPNs, webmail and critical systems, using passwords of 15 to 64 characters with lockouts after repeated failures, keeping encrypted offline backups and testing restores, segmenting networks, and applying least privilege and just-in-time admin access.
In our reading, the CVE list is the finding for operators. The five flaws date from 2020 to 2024, so the group is working through edge-device bugs that have had years of patch time. For utilities and plant operators, that makes the first task an inventory of VPN and firewall firmware, which fits the work behind the Accenture, Dragos and SANS foundation for under-resourced utilities. Edge management planes also keep turning up as entry points, as in the PAN-OS update for CVE-2026-0322. Check each listed CVE against your own devices this week and compare the published indicators with your logs.
Source: CISA, #StopRansomware: SafePay Ransomware, AA26-293A, Oct. 20, 2026
