SafePay Ransomware: At Least 600 Victims and Multiple Intrusion Paths to Double Extortion

1. Basic Information

• Article Name: #StopRansomware: SafePay Ransomware
• Publishers: FBI / CISA / USSS / State Office of Criminal Investigation Rhineland-Palatinate (LKA) / UK NCA / UK NWROCU
• Publication Date: 2026-10-20
• Source: FBI / CISA / USSS / State Office of Criminal Investigation Rhineland-Palatinate (LKA) / UK NCA / UK NWROCU
• Related Sources: The Record summary, CISA: #StopRansomware: SafePay Ransomware
• Related Malware / Threat Groups: SafePay ransomware, SafePay
• Related CVEs: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766
• Related Products: AnyDesk, TeamViewer, PsExec, WinRM, RDP, OneDrive, ScreenConnect
• Severity: Critical
• Severity Rationale: Based on law enforcement investigations, at least 600 victims and impacts on commercial entities and critical infrastructure have been reported, with lateral movement using legitimate remote management tools, security tool termination, data exfiltration, and encryption confirmed (this does not mean all TTPs were confirmed in every single incident).
• Update Rationale: Updated to align the primary source, prerequisites, observation scope, confidence statements, and ATT&CK mappings with primary sources and official specifications. This editorial update is distinct from the original source's publication or update timestamp.

2. Quick Summary

The US FBI, CISA, and USSS, alongside Germany's State Office of Criminal Investigation Rhineland-Palatinate (LKA), the UK NCA, and NWROCU, published a joint advisory stating that SafePay ransomware has been active across North America, South America, Europe, and Australia since August 2024, impacting at least 600 victims. Attackers gain access via password guessing, phishing, known vulnerabilities, and misconfigurations in public-facing edge devices, subsequently using legitimate accounts and remote management tools for lateral movement, data exfiltration, and encryption in double extortion campaigns.

3. Attack Flow

1. Initial Access: Gain entry using password guessing, phishing, known vulnerabilities or misconfigurations in public-facing edge devices, or compromised credentials.
2. Account Operations and Internal Discovery: Create or hijack accounts, then explore internal networks, SMB shares, and critical hosts.
3. Lateral Movement and Disabling Defenses/Backups: Move laterally using PsExec, WinRM, RDP, and remote monitoring and management (RMM) tools, while stopping security software and backup-related processes.
4. Data Exfiltration and Encryption (Double Extortion): Archive data using tools like 7-Zip or WinRAR for external exfiltration, encrypt systems using SafePay ransomware, and apply double extortion tactics including telephone pressure.

Attack Stage	Main Techniques and Tools Reported in the Joint Advisory	Interpretation Notes
Initial Access	Password guessing, phishing, five CVEs on public systems (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766), exploitation of leaked credentials	Aggregation of paths confirmed across multiple incidents; this does not imply that every victim experienced the same CVEs being exploited or administrator accounts without MFA being abused
Discovery & Lateral Movement	Account creation and hijacking, SMB share discovery, RDP, PsExec, WinRM, AnyDesk, TeamViewer, ScreenConnect	Because legitimate RMM and management tools are abused, distinguishing malicious activity from legitimate administrative use is necessary
Defense Evasion, Exfiltration & Impact	Stopping security functions and backups, compression via 7-Zip / WinRAR, uploading to OneDrive etc., .SafePay encryption, telephone threats	Summary of campaign-wide TTPs based on law enforcement investigations up to August 2026

4. Attacker Position and Execution Location

• External attackers with reachability to internet-exposed VPNs, firewalls, and RDP endpoints
• Hands-on-keyboard operators acquiring valid domain or administrator accounts to conduct interactive operations
• Actors abusing legitimate remote monitoring and management (RMM) tools to deploy ransomware

5. Perspective of Victims and Administrators

Victims

• Manifests as business service disruptions, file extensions renamed to .SafePay, placement of ransom notes, and direct telephone pressure directed at the victim organization.
• Victims face threats to publish stolen data alongside the costs of system recovery.

Administrators and SOCs

• Continuous observation of logins to VPNs and RDP, account creation and permission modifications, deployment of RMM tools, file share enumeration, and the termination of backups and security features.
• Extensive file renaming and encryption immediately follow the archiving of large volumes of data and uploads to cloud storage.

6. Success and Failure Conditions

Success Conditions

• The presence of unpatched known vulnerabilities or misconfigurations in public-facing edge devices, or weak credentials that are easily guessed or reused.
• Inference: For intrusion paths utilizing credentials, available accounts and authentication/MFA settings are relevant. Meanwhile, alternative paths exploiting unpatched public service vulnerabilities have also been reported, meaning that "admin accounts without MFA" cannot be treated as the initial condition for all incidents.
• Unrestricted permission for internal RMM, SMB, remote execution, and outbound data transfer.

Failure Conditions and Mitigations

• Prioritize patching known vulnerabilities in public-facing systems and disable unnecessary local or legacy authentication. Apply phishing-resistant MFA to authentication paths such as VPNs and administrative access where feasible; however, do not treat the deployment of MFA alone as a resolution for vulnerability-based intrusions or existing compromises.
• Implement an allowlist for RMM tools, admin tiering, outbound traffic controls, and immutable or offline backups.
• Enforce strict credential hygiene and execute organization-wide account resets across the entire domain in the event of an incident.

7. What Happens Upon Success

• At least 600 victims and impacts on commercial entities and critical infrastructure, based on law enforcement investigations.
• Data exfiltration, system encryption, business and service interruption, and financial/reputational loss.
• Double extortion through data theft and encryption, with threats to publish stolen data and direct phone calls adding payment pressure.

8. Observable Logs

Inference: The following items are candidates for investigation within your organization. Availability depends on products, permissions, log settings, and retention periods; do not attribute incidents or confirm compromises based solely on individual suspicious operations or missing logs.

Email

• Check for email attachments and links associated with phishing, as well as notifications and alerts regarding credential theft.

Proxy / SWG / DNS

• Check for the download traffic of RMM tools, bulk uploads to cloud storage (such as OneDrive), and communications with known IOCs.

Endpoint / EDR

• Check for the execution of PsExec, WinRM, RDP, AnyDesk, TeamViewer, and ScreenConnect, the termination of security functions or backup services, and the deletion of Volume Shadow Copies.

Identity / IdP

• Check for patterns of authentication failure followed by success (failed→success) on VPN, local, and domain administrator accounts, alongside new account creation, password changes, and signs of MFA bypass.

SaaS / Cloud

• Check for bulk data uploads to services like OneDrive and the use of unusual applications or sessions.

Network

• Check for SMB share enumeration, internal lateral movement, remote service connections, and large outbound data transfers.

9. Attack Success Determination

• Subsequent Compromise Confirmed
• Rationale: Publicly, the joint advisory reports actual compromise activity, including data exfiltration and encryption, affecting at least 600 victims based on law enforcement investigations. This information is based on investigations up to August 2026 and does not represent a statistical tally confirming identical behavior across all victims.
• Scope: This does not imply that every technique reported was used in every individual victim organization, but rather aggregates TTPs confirmed across the broader campaign.

10. Investigation Playbook

• Trigger: Check for suspicious execution of PsExec, WinRM, RDP, AnyDesk, TeamViewer, and ScreenConnect, the termination of security features or backups, and shadow copy deletion.
• Initial Verification: Normalize target assets, accounts, and event timestamps to UTC/JST, and preserve relevant logs.
• Endpoint / Server Investigation: Investigate the sequence of VPN/RDP logins, account modifications, RMM deployments, share enumeration, and the termination of backups and security controls.
• Authentication / Cloud Investigation: Check for authentication failures followed by successes on VPN, local, and domain administrator accounts, new account creation, password changes, and MFA bypass.
• Subsequent Operations: Proceed to identify the creation of data archives, large-scale exfiltration to the cloud, and the scope of encryption (the joint advisory reports impacts on at least 600 victims overall).
• Containment: Prioritize patching known vulnerabilities in public systems and disable unnecessary local and legacy authentication. Apply phishing-resistant MFA to authentication paths like VPNs and administrators where possible, while recognizing that MFA alone does not resolve vulnerability-based entry or existing compromises; isolate compromised hosts and reset credentials across the entire domain.
• Determination Categories: Clearly separate contact, execution, successful authentication, information gathering, and subsequent compromise, without presuming unconfirmed success.

11. Defense and Detection Ideas

• Single Event: Detect unauthorized execution of PsExec, WinRM, RDP, AnyDesk, TeamViewer, and ScreenConnect, the termination of security and backup services, and shadow copy deletion.
• Time-Series Correlation: Monitor the sequence of password guessing, phishing, edge vulnerabilities/misconfigurations, or compromised account entry → account creation/hijacking and network/SMB share enumeration → lateral movement via PsExec / WinRM / RDP / RMM and stopping security/backups → data archiving/exfiltration and encryption by SafePay ransomware.
• Threat Hunting: Hunt for SMB share enumeration, lateral movement traffic, remote service utilization, and large outbound data transfers.
• Log Limitations: The country-specific and industry-specific breakdown of the at least 600 victims cannot be determined from public information alone.
• Prioritized Mitigations: Prioritize patching known vulnerabilities in public systems and disable unnecessary local and legacy authentication. Apply phishing-resistant MFA to authentication paths such as VPNs and administrators where feasible (noting that MFA alone does not resolve vulnerability-based entry or existing compromises). Implement RMM allowlisting, admin tiering, outbound traffic controls, and immutable/offline backups, alongside strict credential hygiene and domain-wide account resets during incidents.

12. Facts, Inference, and Hypothesis

Facts

• The joint advisory states that SafePay has impacted at least 600 victims since August 2024, making it one of the most active ransomware groups in 2026.
• Initial access involves password guessing, phishing, known vulnerabilities and misconfigurations in public-facing edge devices, and compromised credentials.
• Post-intrusion activities progress through account creation and hijacking, network and share discovery, abuse of legitimate remote management tools, disabling defense functions, archiving and exfiltration, and encryption.
• AnyDesk and TeamViewer are used to transfer the ransomware payload, and double extortion is conducted by stealing data prior to encryption.
• The attackers have also been reported to make direct phone calls to victim organizations to pressure them into paying ransoms.
• The figure of "at least 600" represents impacted entities based on law enforcement investigations, rather than a tally solely derived from listings on leak sites.

Inference

• Because operations center around legitimate accounts and RMM tools, defenders must correlate account activities, remote tool deployments, data staging, and backup termination in a time-series manner rather than relying solely on malware hashes.
• Unless patch application on edge devices is accompanied by simultaneous auditing of MFA policies, local accounts, and misconfigurations, entry vectors will persist.

Hypothesis

No additional hypotheses. Unconfirmed items are documented under "Unresolved Items and Further Investigation".

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	The joint advisory reports initial access leveraging five CVEs in public systems. This does not apply to all victims. Definition
T1078	Valid Accounts	high	Reports VPN and other access and account abuse using leaked or guessed credentials. Definition
T1021.001	Remote Services: Remote Desktop Protocol	high	The advisory specifies lateral movement within the network using RDP. Definition
T1219.002	Remote Access Tools: Remote Desktop Software	high	Reports abuse of AnyDesk, TeamViewer, and ScreenConnect. Legitimate use is not classified as malicious. Definition
T1685	Disable or Modify Tools	high	Maps the termination and disabling of security software reported in the advisory to current ATT&CK T1685. Definition
T1560.001	Archive Collected Data: Archive via Utility	high	Reports compression of collected data using 7-Zip, WinRAR, etc. Definition
T1486	Data Encrypted for Impact	high	Reports file encryption by SafePay following exfiltration. Definition

14. Unresolved Items and Further Investigation

• Country-specific and industry-specific breakdowns of the at least 600 victims
• All initial access brokers (IABs) and sources of compromised credentials that were exploited
• The specific percentage of incidents attributable to each of the five reported CVEs
• Current operator composition and the presence of affiliate programs

15. Impact on SOCs and Organizations

Organizations should conduct audits and inventories of VPNs, firewalls, and RDP endpoints—including lingering local accounts and MFA exceptions—and implement correlated monitoring of the sequence leading from suspicious RMM deployments, SMB share enumeration, security/backup termination, and cloud uploads of archives, to final encryption.

16. Summary by Audience

• For SOCs: Monitor for SMB share enumeration, lateral movement, remote service connections, and large outbound data transfers, alongside suspicious executions of PsExec, WinRM, RDP, AnyDesk, TeamViewer, and ScreenConnect, termination of security and backup services, and shadow copy deletion.
• For Administrators: Prioritize patching known vulnerabilities in public-facing systems and disable unnecessary local and legacy authentication. Apply phishing-resistant MFA to authentication paths such as VPNs and administrators where feasible, and do not treat MFA alone as sufficient to resolve vulnerability-based entry or existing compromises.
• For Users: If you encounter suspicious notifications, operational failures, or authentication prompts, do not act on your own judgment; promptly contact your system administrator.