SafePay Ransomware Has Hit 600 Victims and the Bugs It Uses Have Been Patchable for Years

Key points - A joint advisory published 20 October 2026 by the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and two UK agencies names five specific software flaws the SafePay ransomware gang uses to break into company networks. - The advisory counts at least 600 SafePay victims since August 2024 across North America, South America, Europe and Australia. - Threat Vectr's own leak-site tracking has recorded 361 claimed SafePay victims since 1 July 2025, with manufacturing the most common sector in our data. - Four of the five flaws are already on CISA's Known Exploited Vulnerabilities list, with federal patch deadlines that passed between September 2023 and November 2024. - The gang connects through the Mullvad VPN service using stolen or guessed passwords, then uses tools already on the victim's own computers to spread.

SafePay is a ransomware group: criminals who break into company networks, scramble files so no one can read them, and demand cryptocurrency to restore access. On 20 October 2026 the FBI and five partner agencies published a joint advisory saying the group has hit at least 600 organisations since August 2024.

The advisory does something unusually useful. It names the exact software flaws SafePay is walking through.

Which bugs is SafePay using?

Five, all in the kind of equipment that sits at the edge of a company network: firewalls and backup servers. Four are already on the US government's must-patch list.

CVE-2020-3259 in Cisco's Adaptive Security Appliance lets an internet-facing attacker read chunks of device memory by sending a malformed web request. That memory can hold session tokens or credentials. Cisco patched it in May 2020. SafePay's still finding boxes nobody updated.

CVE-2024-40711 in Veeam Backup & Replication is the ugliest of the set. An unauthenticated attacker can run arbitrary code on the backup server. For a ransomware crew, taking backups first is the whole point: no restore path, no alternative to paying.

How do they get in and move around?

According to the advisory, SafePay operators connect through the Mullvad VPN service using account details harvested from phishing emails, meaning fake messages designed to trick staff into typing passwords into a lookalike login page. They also run brute-force attempts against accounts using common passwords.

Once inside, they don't drop exotic malware. They use tools that come with Windows: PsExec and WinRM for running commands on remote machines, Remote Desktop for jumping between servers, and PowerShell scripts such as ShareFinder.ps1 to list file shares worth stealing. Defenders call this living off the land, and it's hard to spot because the activity looks like normal admin work.

Files get bundled and exfiltrated, then encryption runs. In some cases SafePay has reset user passwords so staff can't log back in to interrupt the attack.

How big is SafePay, really?

The advisory says 600 victims since August 2024. Threat Vectr's own leak-site tracking, which counts the organisations SafePay publicly names on its extortion blog, has logged 361 claimed victims since 1 July 2025 across 19 sectors, with manufacturing the single most common target in our data. We first reported on the group on 13 October when it claimed a US healthcare and marine biotechnology company. These are claims the criminals themselves posted, not independently confirmed breaches.

SafePay isn't clever. It's patient, and it's cataloguing the companies that never got around to applying patches their vendors shipped years ago. If your organisation runs Cisco ASA or Veeam on the perimeter, those five CVEs are the list to work through this week.

Should you worry?

If you work for a company using any of the affected products, ask your IT team whether those five CVEs are patched. That's a fair question and the answer should be yes. Don't click links in emails asking you to log into a VPN or company portal; open the site from your bookmarks. Turn on multi-factor authentication wherever your employer offers it. The advisory highlights it as one of the controls that actually stops this group.