SafePay ransomware: how it gets in and what to do

What happened

On 20 October 2026 the FBI, CISA, the US Secret Service and law enforcement partners in Germany and the UK published a joint advisory about SafePay, a ransomware group active since August 2024. The advisory says SafePay has affected at least 600 separate victims across several critical infrastructure sectors.

How they get in

According to the advisory, attackers typically start with one of these:

• Stolen or exposed passwords, and brute-force attempts to guess them.
• Access through VPN accounts.
• Internet-facing devices, such as firewalls, that have known flaws and have not been patched.

What they do next

• They go after your backups. The advisory says they stop the Windows shadow copy service, reset network storage that holds backups to factory settings and, in some cases, deleted all network-attached backups.
• They steal data first, then encrypt files. Encrypted files get a .SafePay extension.
• They pressure the victim. A ransom note points to a chat portal, a group representative phones the victim, and the stolen data is posted on a leak site if the victim does not pay.

What the agencies recommend

1. Patch quickly, starting with systems that face the internet.
2. Use multi-factor authentication, especially for email, VPN and critical accounts.
3. Use long, unique passwords, lock accounts after repeated failures, and avoid forcing frequent resets.
4. Keep encrypted, offline or immutable backups, in more than one separate place, and test restoring them regularly.
5. Limit admin accounts and give people only the access they need.
6. Segment the network and use monitoring that can spot unusual activity.

Our take for a small team

Our advice, not from the advisory: two of these steps cost little and matter most for a small company. First, protect the accounts that can reset everything else, starting with email. Second, keep a backup copy that an intruder with your main account cannot delete, and restore it once to prove it works. Our runbooks #4 (Account Lockdown) and #5 (Backup and Restore) are built for exactly these two.

A note on the technical details

The advisory also lists indicators of compromise for security teams. It warns that some of the tools listed are legitimate and that addresses should be verified before blocking. If you run security for a larger organisation, read the full advisory.