SafePay ransomware wipes backups before encrypting, FBI warns

A factory reset. That is the fate SafePay ransomware operators reserve for the network-attached storage (NAS) servers that hold their victims' backups, just before they encrypt everything else. The detail appears in a joint advisory published on October 20 by the FBI, the U.S. cybersecurity agency CISA and the U.S. Secret Service. It was co-signed by the criminal police of the German state of Rhineland-Palatinate, the UK's National Crime Agency (NCA) and the North West Regional Organised Crime Unit in northwest England.

The agencies' tally: at least 600 victims since the group appeared in August 2024, including businesses and critical infrastructure operators in North and South America, Europe and Australia. The authorities rank SafePay among the most active ransomware groups of 2026. The advisory names no victims.

How do the hackers get in?

Nothing exotic. According to the advisory, SafePay gains initial access with stolen or guessed credentials, brute-force attacks against passwords and VPN access, using IP addresses from the commercial VPN provider Mullvad. The agencies also cite five known vulnerabilities, patched long ago, in internet-facing devices:

• CVE-2020-3259 and CVE-2023-20269, exploited with accounts obtained through phishing (Cisco ASA and Firepower firewalls and VPNs);
• CVE-2023-27532 and CVE-2024-40711, in Veeam Backup & Replication backup software;
• CVE-2024-40766, in SonicWall firewalls.

For the last three, the attackers scan the internet with automated scripts, the advisory says.

Once inside the network, administrator tools

What follows looks like an IT administrator's work. The attackers move around with PsExec, PowerShell, WinRM or Remote Desktop, steal passwords with Mimikatz and establish persistence with the remote access tool ScreenConnect, while AnyDesk and TeamViewer are used to transfer the malware. The data is compressed, then exfiltrated with RClone, WinSCP, FileZilla, Backblaze or OneDrive. The agencies warn that these legitimate programs should not be judged malicious without evidence that an attacker is using or controlling them.

Then comes double extortion. The Windows Volume Shadow Copy service is stopped, backup NAS devices are reset “to hinder system recovery attempts,” then the files are encrypted and given the .SafePay extension. The ransom, payable in cryptocurrency, is generally a share of the victim's revenue, according to the advisory. The group's representatives even phone their targets. If the victim does not pay, the stolen data is published. The agencies say they discourage paying, which does not guarantee that files will be recovered.

What should you do?

Since everything starts with weak passwords and unpatched devices, the recommendations focus first on the front door:

• patch already-exploited vulnerabilities first on exposed devices (VPNs, firewalls, backup servers), starting with the five cited;
• enforce multifactor authentication on the VPN, web mail and critical accounts;
• require long passwords (at least 15 characters), lock accounts after several failed attempts and filter connections to remote access services coming from untrusted origins;
• keep encrypted, immutable, offline backups, and regularly test restoring them;
• audit domain controllers, servers, workstations and Active Directory to spot new, inactive or unknown accounts.

Indicators of compromise can be downloaded with the advisory. The involvement of a German police force is a reminder that Europe is part of the hunting ground, as with Qilin, whose alleged member was arrested in Japan and then handed over to Germany. No arrest is mentioned this time: SafePay, which works without affiliates according to BleepingComputer, remains active.