A multinational group of law-enforcement and cybersecurity agencies warned on October 20, 2026, that SafePay ransomware operators have compromised at least 600 organizations, including victims across multiple critical-infrastructure sectors.
The joint advisory, designated AA26-293A, was issued by the FBI, the Cybersecurity and Infrastructure Security Agency, the U.S. Secret Service, Germany’s Rhineland-Palatinate State Criminal Police Office, the United Kingdom’s National Crime Agency, and the UK North West Regional Organised Crime Unit.
SafePay has operated since at least August 2024 and was among the most active ransomware groups during 2026. Investigated attacks have affected organizations in North America, South America, Europe, and Australia.
The advisory is based on government investigations and observations extending through August 2026, making it more authoritative than victim claims posted on criminal leak sites.
HOW SAFEPAY GAINS INITIAL ACCESS
Investigators found that SafePay operators use several entry methods rather than depending on a single exploit.
Observed techniques include stolen or phished account profiles, password guessing and brute-force attacks, compromised virtual private network credentials, and exploitation of vulnerable internet-facing systems.
The agencies associated SafePay access activity with five previously disclosed vulnerabilities:
CVE-2020-3259
CVE-2023-20269
CVE-2023-27532
CVE-2024-40711
CVE-2024-40766
The advisory also says SafePay has used IP addresses belonging to the Mullvad VPN service when accessing victim networks. This does not mean Mullvad itself is malicious or compromised. Defenders should treat such infrastructure as one contextual signal and verify activity before blocking addresses.
ATTACKERS USE LEGITIMATE ADMINISTRATION TOOLS
Once inside a network, SafePay operators attempt to obtain administrative privileges on existing accounts or create new accounts. They then rely heavily on legitimate Windows and remote-management capabilities.
Observed tools include PsExec, Windows Remote Management, Remote Desktop Protocol, ScreenConnect, AnyDesk, and TeamViewer. SafePay has also used PowerShell scripts and utilities such as ShareFinder and SharpShares to locate network shares and identify valuable data.
This reliance on legitimate software can make an intrusion difficult to distinguish from normal administrative activity. Organizations need behavioral monitoring that detects unusual account creation, remote execution, file-share enumeration, security-control changes, and administrative activity outside established workflows.
Investigators have observed the operators disabling security software, changing user passwords, concealing code with software-packing techniques, and using User Account Control bypasses or token impersonation to elevate privileges.