The ransomware story in cybersecurity news today carries six government seals. On October 20, 2026, CISA, the FBI, the U.S. Secret Service, Germany's LKA Rheinland-Pfalz, the UK National Crime Agency and the North West Regional Organised Crime Unit published a joint advisory on SafePay, one of the most active ransomware groups of the year. The count: more than 600 organizations across critical infrastructure sectors since August 2024. The method is not exotic: stolen passwords, VPN weaknesses, phishing, and five known vulnerabilities in edge and backup products, every one of them already patched by its vendor. Then, before the encryption starts, they go for the backups. The four-question check below tells you whether your network matches the victim profile.
Every one of the five CVEs named in the advisory has a vendor fix available: 100 percent of them. That is the sentence to sit with. SafePay's edge is not a secret weapon; it is the gap between a fix existing and a fix being installed, multiplied by passwords that were never rotated and backups that were never isolated.
| CVE | Product | Flaw |
|---|---|---|
| CVE-2020-3259 | Cisco ASA / Firepower | Information exposure in web services |
| CVE-2023-20269 | Cisco ASA / Firepower | Remote-access VPN authentication failure |
| CVE-2023-27532 | Veeam Backup & Replication | Credential exposure |
| CVE-2024-40711 | Veeam Backup & Replication | Unauthenticated remote code execution, CVSS 9.8 |
| CVE-2024-40766 | SonicWall SonicOS | Improper access control on management and SSL-VPN access |
Read the product column again: firewalls, VPN gateways, and the backup server itself. The list is the attack plan in miniature: get in at the edge, then own the system that holds the recovery copies. CVE-2024-40711 deserves its own line: an unauthenticated attacker who can reach a Veeam server can run code on it, and Veeam is where the backups live.
Older ransomware advice ended at "keep good backups." SafePay's playbook is why that advice now has a second half. The advisory says the group may delete volume shadow copies and reset network-attached storage devices that hold backups, before encryption. A NAS on the same network, administered with the same credentials as the servers it protects, is not a recovery plan; it is a second target with the word backup written on it. Analysts believe SafePay also sits behind the November 2024 attack on the U.S. business services firm Conduent, which agreed an $80 million class-action settlement over that breach on October 16, 2026; the attribution is reported as a belief, not a confirmed finding, and it is labeled that way here. What is confirmed is the shape: credentials and known flaws in, legitimate tools for movement, data out, backups destroyed, then encryption.
Answer for your whole network, not your best server. Everything runs in your browser; nothing is sent anywhere.
BreachHunter — Ingenious AI's intrusion and breach-signal hunter — is built for the gap between an advisory like this one and an intrusion already in progress: the accounts, tools and backup tampering that show before the encryption does. Get early access on WhatsApp.
1. How many organizations has SafePay affected, per the joint advisory?
2. What is unusual about SafePay's structure?
3. Which entry routes does the advisory name?
4. What does SafePay do to backups?
5. What does paying the ransom guarantee, per the agencies?
SafePay is a ransomware group that has operated since August 2024 as a private crew with no affiliates. It breaks into business networks through stolen passwords, VPN weaknesses and known flaws in edge devices, steals data, then encrypts systems and threatens to publish the stolen files. A joint advisory from CISA, the FBI, the U.S. Secret Service and European partners, published October 20, 2026, counts more than 600 victim organizations.
Five: CVE-2020-3259 and CVE-2023-20269 in Cisco ASA and Firepower VPN and web services; CVE-2023-27532 and CVE-2024-40711 in Veeam Backup and Replication, the second an unauthenticated remote code execution flaw rated CVSS 9.8; and CVE-2024-40766 in SonicWall SonicOS access control. Every one of the five is a known vulnerability with a vendor fix available. SafePay's scripts look for the unpatched ones.
The advisory lists exposed or stolen credentials, brute-force password attacks, phishing, and exploitation of VPN access and internet-facing systems. Investigators observed connections coming from Mullvad VPN addresses, and the group uses automated scripts to exploit known CVEs in edge devices. Once inside, actors take over or create administrative accounts, move with legitimate tools such as PsExec, WinRM and RDP, map network shares, steal data, and disable security measures before encrypting.
Because recovery is the victim's way out, and SafePay closes it. The advisory says the group may delete volume shadow copies and reset network-attached storage devices that hold backups, so when encryption lands, the obvious restore points are already gone. Backups that sit on the same network, reachable with the same credentials as everything else, are part of the target. Isolated, immutable or offline backups with separate credentials are the defense, and only a tested restore proves they work.
Start at the edge, in the advisory's own order: patch VPNs, firewalls and other internet-facing devices, starting with the five named CVEs if you run Cisco, Veeam or SonicWall products. Put MFA on every remote-access account, including vendor and service accounts. Audit administrative accounts for ones you did not create. Restrict administrative tools and privileges to the people who need them. Then isolate backups from the network they protect and test a restore.
Sources: the joint Cybersecurity Advisory on SafePay ransomware (CISA, FBI, U.S. Secret Service, LKA Rheinland-Pfalz, UK National Crime Agency, North West Regional Organised Crime Unit, October 20, 2026), as announced on CISA's official Facebook page and reported by GBHackers, October 2026 (the five CVEs, the backup-system attacks, the Mullvad observation) and Cybersecurity News, October 2026 (the 600+ count, the private-group structure, the investigation window). NCC Group and BlackKite activity rankings as carried in that coverage.