Six agencies. Three countries. At least 600 victims since August 2024. That’s SafePay, per the joint #StopRansomware advisory CISA, the FBI, the Secret Service and UK and German police published yesterday (AA26-293A). The advisory calls it “among the most active ransomware groups in 2026.”
The CVE list is the part to read slowly. Five bugs. None of them new.
Two are Cisco ASA and FTD: CVE-2020-3259 and CVE-2023-20269. Two are Veeam Backup & Replication: CVE-2023-27532 and CVE-2024-40711. One is SonicWall: CVE-2024-40766. SafePay uses phished accounts over Mullvad VPN IPs against the Cisco pair, and automated scripts against the rest (per CISA).
The point of view. This isn’t a group with a zero-day budget. It’s a group with a process. Edge device for the door. Backup server for leverage. Everything else is living off the land.
Look at what happens after entry. PsExec, WinRM and RDP for movement. ShareFinder.ps1 and SharpShares to find the data. RClone, WinSCP, FileZilla, OneDrive and Backblaze’s b2.exe to take it. AnyDesk, TeamViewer and ScreenConnect to stay. Then the recovery kill: stop Volume Shadow Copy and reset network-attached storage holding backups to factory settings. In some cases, all network-attached backups were deleted (per CISA).
A Veeam server is the best box in the building for an attacker. It holds credentials to almost everything it backs up. It knows where every copy lives. Own it, and you own both the data and the victim’s ability to say no.
What to hunt for this week. VPN logins from Mullvad exit ranges, especially on accounts that just passed MFA from a new device. PsExec or WinRM fan-out from a single host. ShareFinder or SharpShares on any endpoint. RClone, b2.exe or WinSCP on a server that has never run them. New remote admin tools installed outside your RMM. And any factory reset or config wipe on a NAS. That last one should page someone at 2 a.m. The advisory’s STIX IOCs are ready to load, but the behaviors will outlast the hashes.
What to fix. Patch the five, obviously. Then the harder part. Take the backup console off the domain, or at least off domain admin. Put it behind its own MFA. Keep one copy immutable and one offline, which is CISA’s own recommendation. And test a restore from the copy an attacker with domain admin couldn’t touch. If you can’t name that copy, you don’t have one.
The market read. For two years, recovery has been pitched as a resilience story and bought as an insurance line. Advisories like this one turn it into a security control. That helps vendors who sell immutability and isolated recovery as a separate trust domain, and it raises the bar for any backup product that runs on a domain-joined Windows server with the keys to the kingdom.
It also says something about edge security. The two Cisco CVEs date from 2020 and 2023. The SonicWall bug is from 2024. Six hundred victims later, the exploit isn’t the problem. The patch cadence on boxes nobody owns is. That’s an argument for managed edge, or for retiring appliance VPN entirely in favor of something identity-aware. Either way, the line item already exists. It’s called the next incident.
Our take: SafePay is a mid-tier crew running a top-tier playbook, and the playbook is boring on purpose. The defenders who stop it won’t need a new tool. They’ll need someone to own the VPN appliance and the backup server like they’re crown jewels. Because to SafePay, they are.