SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers

SafePay ransomware has affected at least 600 separate victims across multiple critical infrastructure sectors, according to a joint government advisory released on October 20, 2026.

Active since August 2024, the group has targeted businesses and essential services across North America, South America, Europe, and Australia, becoming one of the most active ransomware threats in 2026.

The attacks combine stolen passwords, exposed remote access services, and known software flaws. After entering a network, attackers take control of accounts, search for valuable files, steal data, and damage recovery systems before encrypting files.

This sequence puts victims under pressure from both business disruption and the threat of stolen information being published online.

Analysts at CISA and partner agencies noted these SafePay activities in the joint SafePay ransomware advisory, which draws on investigations conducted through August 2026.

Contributors include the FBI, United States Secret Service, German investigators, and UK law enforcement. Their findings describe an operation that relies heavily on trusted accounts and common administration tools.

SafePay Ransomware Has Affected 600+ Organizations

SafePay operators gain access through exposed credentials, repeated password guesses, phishing, and vulnerable internet-facing systems. Earlier reporting on SafePay RDP and VPN attacks also documented the group’s use of compromised remote connections.

The latest advisory adds details about automated exploitation and the abuse of phished account profiles to enter victim networks.

The agencies identified exploitation involving CVE-2020-3259 and CVE-2023-20269 in edge devices, alongside CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 across internet-exposed systems.

Attackers also connected through Mullvad VPN addresses. That finding describes the service being used during intrusions; it does not mean Mullvad itself was compromised or that its ordinary users are linked to SafePay.

Backup infrastructure is another important target. CVE-2024-40711 affects Veeam Backup & Replication and allows unauthenticated remote code execution.

Previous Veeam ransomware exploitation cases showed attackers combining compromised VPN access with this flaw to create administrator accounts.

Those earlier incidents involved other ransomware families, highlighting a shared weakness rather than proving a direct connection between the groups.

Trusted Tools Help Attackers Spread

Once inside, SafePay operators create accounts or raise the permissions of existing ones. They use PsExec, Windows Remote Management, and Remote Desktop Protocol to run commands and reach other machines.

Since these tools also support normal IT work, defenders need to examine who launched them, where they ran, and whether their use fits approved activity.

The attackers search shared folders for useful files, disable security software, and sometimes change user passwords, locking legitimate staff out. Investigators also observed methods that bypass Windows User Account Control and reuse security tokens to gain higher access.

Code packing helps hide malicious programs, while remote support applications provide another route for moving software onto compromised systems.

For data theft, SafePay uses familiar tools including 7-Zip, WinRAR, RClone, WinSCP, and FileZilla. Some incidents involved OneDrive or Backblaze storage.

These applications are not automatically malicious: the warning signs are their unexpected deployment, unusual data transfers, and connections to accounts outside the organization’s control, particularly when combined with other signs of compromise.

The group’s focus on recovery makes its attacks especially disruptive. Operators stop the Volume Shadow Copy Service and have reset network-attached storage holding backups to factory settings.

Related reporting on SonicWall access control flaws shows why securing remote access matters before attackers can reach internal systems and backup resources.

After stealing data, SafePay encrypts files using ChaCha20 together with RSA. The ransomware can encrypt whole files or selected portions depending on file type and size.

Victims receive a ransom note directing them to a Tor chat portal, while phone calls and threats to publish stolen data add pressure. The malware may delete itself afterward.

CISA and its partners urge organizations to patch exposed systems, require multifactor authentication, and limit administrator rights. Backup copies should remain offline or protected against changes and deletion, with restoration tested regularly.

Separating networks can also restrict the path from a compromised remote access account to servers holding sensitive files and recovery data.

Security teams should review unfamiliar accounts, unexpected remote tools, disabled protections, and unusual outbound transfers together rather than treating each event in isolation.

If an intrusion is suspected, the agencies recommend isolating affected machines, preserving logs, and investigating its scope. They discourage ransom payments because payment does not guarantee file recovery and can support further criminal activity.

Indicators of compromise (IoCs):-

IP Addresses

IP address	Reported association
104.26.2[.]223	SafePay victim intrusion
140.82.114[.]4	SafePay victim intrusion
185.199.108[.]133	SafePay victim intrusion
77.37.49[.]40	SafePay victim intrusion
173.194.194[.]94	Hosting victim data
167.235.225[.]149	Client login panels
5.255.11[.]134	Data exfiltration
88.119.167[.]239	soc.dll command and control
37.10.71[.]188	Data exfiltration

Source: CISA advisory, Table 2.

SHA-1 Hashes

File or description	SHA-1
1.exe — ransomware binary	07353237350c35d6dc2c8f143b649cd07c71f62b
Locker.dll — PE32 executable	b498a2683640c983bb069fa2ea9e67cef4a3797d
locker.dll	BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081
nxc	d711a5af5aed48a3b36b98f4fcf52809aebef7a2

Source: CISA advisory, Table 4.

SHA-256 Hashes

File or description	SHA-256
soc.dll	921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae
RunPE bundled DLL	6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a
Injected PE	e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346
locker.dll — PE32 executable	327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917
locker.dll	a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526
SharpShares.exe	BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41

Source: CISA advisory, Table 5.

Filenames and File Patterns

Filename or pattern	Context reported in the advisory
1 - Copy.bat	Script likely used to copy, stage, or move files
CCleaner.exe / CCleaner64.exe	Legitimate cleanup tools; investigate unexpected enterprise deployment
CCleaner*.exe / *.dll	Possible abuse or impersonation of CCleaner components
dcsync.exe	Active Directory credential extraction
domains.txt	Likely output containing domain information
DYRasWtb.exe	Suspected malicious executable
libsmb2.dll	SMB library that may support file transfer or network movement
Libwa*.dll	Suspicious libraries requiring further analysis
License.txt	Benign filename observed with “S.P_Network Scanner”
locker.dll	Potential ransomware or encryption component
netscan.exe	Network discovery and scanning
netscan.lic / netscan.xml	Network scanning configuration or output
netscanNEW.zip	Archive potentially used to stage scanning tools
nltest.exe	Legitimate Windows domain tool; investigate use outside approved workflows
oui.txt	MAC address vendor lookup output
ping.txt	Network connectivity testing output
portable.dat	Possible configuration or staging file
scan.xml	Scanning or discovery output
sharefinder.ps1	Network share discovery script
Socks.exe	SOCKS proxy tool for tunneling traffic
Socks_werfault.exe	Binary likely disguised as a Windows-related process
subs.txt	Possible staging file or target list
svchost.exe	Legitimate Windows process; investigate unusual paths or impersonation
wa_3rd_party_host_*.exe	Suspicious binaries or disguised components
winrar.exe	Legitimate archiving tool used for data staging
AnyDesk.exe	Legitimate remote desktop tool abused to transfer malware
SharpShares.exe	Network share discovery
AcronisDiskDirector-12.5 / acro.exe / DiskDirector.exe / Acronis.exe	Legitimate disk management software
b2.exe	Backblaze B2 command-line tool used for data theft
nxc.exe	NetExec tool for system discovery, credential checks, and remote operations

Source: CISA advisory, Table 3. These names require supporting evidence before being classified as malicious.

Hostnames and Encryption Marker

Type	Indicator
Hostname	WIN-SBOE3CPNAL
Hostname	WIN-3IUUOFVTQAR
Hostname	WIN-DK18BI83M0S
Hostname	WIN-I1HRRJHCEIV
Encrypted-file extension	.SafePay

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers appeared first on Cyber Security News.