SafePay ransomware: Why your VPN and backups are the target

SafePay ransomware is now the subject of a joint warning from the FBI, CISA and the U.S. Secret Service, and the way it gets in should worry any business that lets staff work remotely. The advisory published on October 20, 2026 says the group has hit at least 600 victims since it appeared in August 2024. Its favorite doors are the VPN on your firewall and the backup server in your closet. Once inside, it goes after your backups before it locks your files, so you have nothing clean to restore from.

Our stance is simple. If your remote access still runs on a firewall VPN with password-only logins, treat this advisory as your deadline. Turn on MFA, patch the firmware, and get at least one copy of your backups somewhere SafePay cannot reach. Those three steps close the paths this group uses most.

What the SafePay ransomware advisory says

The advisory, labeled AA26-293A, was written by the FBI, CISA and the Secret Service along with Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit. The full PDF on the FBI’s IC3 site lays out how the group works, step by step. Infosecurity Magazine and Cyber Security News both covered it the next day.

The key points for a business owner:

• SafePay has compromised at least 600 organizations across multiple critical infrastructure sectors, with victims in North America, South America, Europe and Australia.
• It gets in through stolen or guessed passwords, VPN access, phished accounts and known flaws in internet-facing devices.
• Once inside, it uses normal admin tools such as PsExec, Windows Remote Management, Remote Desktop and remote support software to move around.
• It steals data before it encrypts it, using tools such as RClone, FileZilla, WinSCP and 7-Zip, plus cloud storage accounts.
• It shuts off Windows shadow copies, resets backup storage devices to factory settings, and in some cases deletes every network backup it can find.
• If a victim does not pay, the group posts the stolen data on its leak site. The advisory says a representative also phones victims to pressure them.

None of these methods are new, and that matters. SafePay succeeds because many small and mid-size networks still have the same gaps that security agencies have been warning about for years.

Why the VPN is the front door

Most small offices set up remote access years ago. A firewall from Cisco, SonicWall, Fortinet or a similar brand came with a built-in VPN, someone turned it on, and staff have logged in with their normal password ever since. That box sits on the open internet, and attackers scan for it all day.

The advisory lists five specific flaws SafePay has used. Two of them affect the kind of VPN and firewall gear found in many small offices. One, CVE-2023-20269, affects the remote access VPN in Cisco ASA and Firepower Threat Defense software. It lets an attacker try username and password combinations over and over. CISA added it to its Known Exploited Vulnerabilities list in September 2023. Another, CVE-2024-40766, affects SonicWall’s SonicOS management and SSL VPN features and was tied to other ransomware intrusions in 2024, as TechTarget also reported.

Both flaws were made public in 2023 and 2024, and the vendors have published fixes or mitigations. The trouble is that firewall firmware often goes unpatched in small offices. Nobody owns it, updates can mean a short outage, and the box keeps working, so it gets forgotten.

Patching alone does not solve the bigger problem. The advisory says SafePay also uses exposed credentials and brute-force password attacks. If an employee reused their VPN password on a site that was breached, an attacker can simply log in. A VPN that accepts a password alone will let them.

What to do about your VPN this week

• Require MFA on every VPN account. The advisory names VPNs, webmail and accounts that reach critical systems as top priorities for multifactor authentication.
• Update the firewall firmware. Check the vendor’s support site for the current release and apply it during a maintenance window.
• Remove accounts nobody uses. Former employees, old vendor logins and test accounts are easy targets.
• Turn on account lockout. The advisory recommends locking accounts after several failed logins to slow down password guessing.
• Retire hardware that no longer gets updates. CISA’s own required action for the Cisco flaw includes discontinuing unsupported devices.

Some businesses will ask whether they should drop the VPN entirely and move to a cloud-based remote access tool. For many offices that is a good long-term plan, and it is worth discussing with your IT provider. It is a project, though, and SafePay is active today. Lock down what you have first.

Why your backups are a target too

Another flaw on the list is in backup software. CVE-2024-40711 in Veeam Backup & Replication allows remote code execution without logging in. Cyble reported in 2024 that ransomware gangs were already exploiting it, and Veeam patched it in version 12.2. The advisory also lists CVE-2020-3259 and CVE-2023-27532 among the flaws SafePay has used.

Why would an attacker care about backup software? Because backups are the reason a business can refuse to pay. The advisory describes SafePay stopping the Windows Volume Shadow Copy Service, resetting network storage devices that hold backups to factory settings, and deleting network-attached backups. A backup drive that is always plugged into the same network as your servers can be wiped by the same attacker in the same session.

This is where many small businesses get a painful surprise. They pay for backups every month and assume they are covered. Then an attack wipes the backup appliance along with everything else.

What a backup that survives SafePay looks like

• At least one copy offline or immutable. The advisory calls for offline backups and for backups that are encrypted and immutable, which means they cannot be changed or deleted for a set period.
• Stored somewhere separate. It recommends keeping copies of sensitive data in a physically separate, segmented location, such as a separate storage device or the cloud.
• Tested on a schedule. A backup you have never restored from is a guess. The advisory recommends testing restoration regularly.
• Backup software kept current. If you run Veeam or a similar tool on site, make sure it is on a supported, patched version and that its admin console is never reachable from the internet.

We covered what happens once an attack is underway in Ransomware recovery: What the first 24 hours look like. The short version is that recovery speed depends almost entirely on whether a clean backup survived.

Should you pay if SafePay hits you?

This is the debate every victim faces, and SafePay’s phone calls are designed to rush it. The advisory says the group asks for a share of company revenue, paid in cryptocurrency. The agencies behind the advisory do not encourage paying. Coverage of the advisory notes the guidance that payment does not guarantee recovery and can fund further crime.

We agree with that position for nearly every business we work with. Still, we know the decision is rarely simple when payroll, patient records or a contract deadline is on the line. That is exactly why the time to settle it is now, while you can talk calmly with your leadership, your lawyer and your cyber insurance carrier. Write down who makes the call and what facts they need. Then the attacker’s phone call becomes one more input to a plan you already made.

Keep in mind that SafePay steals data before it encrypts anything. Even a business with perfect backups may face a data exposure. For healthcare practices, defense contractors and financial firms, that can trigger reporting duties under HIPAA, DFARS or state breach laws. Your incident plan should name who contacts counsel and regulators.

Signs SafePay may already be inside

The advisory suggests looking at several warning signs together. Any one of these on its own can have an innocent cause. Two or three at once deserve a closer look.

• New, inactive or unfamiliar accounts on your domain controllers, servers or workstations.
• Remote support or file transfer tools you did not install, such as RClone, FileZilla or WinSCP.
• Antivirus or endpoint protection that was turned off.
• Large, unusual uploads leaving your network, especially to cloud storage you do not use.
• VPN logins at odd hours or from VPN services and countries where you have no staff. The advisory notes SafePay activity from Mullvad VPN addresses. Coverage of the advisory points out that this does not mean the VPN provider itself was compromised.

Spotting these patterns is hard for a busy office manager. It is the job that endpoint detection and response tools and the people who watch them are built for. If you want the plain version of how that monitoring works, see What is MDR? Managed detection and response explained.

A 7-day SafePay checklist for business owners

You do not need a full security overhaul to make real progress. Here is what we would ask any client in Maryland, Virginia or DC to get done in the next week:

• List every device that faces the internet: firewall, VPN, remote desktop, backup console and any vendor remote access.
• Confirm each one is on current firmware or software, and patch anything that is behind.
• Turn on MFA for the VPN, email and every admin account.
• Close Remote Desktop to the internet and turn off any ports you do not use.
• Delete or disable accounts that belong to former staff or old vendors.
• Confirm at least one backup copy is offline or immutable, and restore one file from it to prove it works.
• Write down who decides on ransom, insurance and legal calls if something happens.

The advisory also recommends network segmentation, least-privilege admin rights and time-limited admin access. Those take longer to plan, but they make it much harder for an attacker who does get in to reach your servers and backups.

Frequently asked questions

What is SafePay ransomware?

SafePay is a ransomware group active since August 2024. According to the October 2026 FBI and CISA advisory, it has hit at least 600 victims. It steals data, encrypts files with a .SafePay extension, and threatens to publish the data if the victim does not pay.

Does SafePay target small businesses?

The advisory describes victims across many critical infrastructure sectors and does not limit its warning to large companies. The methods it lists, such as weak VPN passwords and unpatched firewalls, are common in small and mid-size offices.

Will MFA stop SafePay?

MFA blocks the easiest path, which is logging in with a stolen or guessed password. It does not fix an unpatched device, so you still need firmware updates and protected backups. The advisory recommends all three.

Is cloud backup enough?

Cloud backup helps when it is separate from your network and protected from deletion. If the same admin account can delete both your servers and your cloud backups, an attacker who steals that account can do the same. Ask your provider whether your backups are immutable.

Get a second set of eyes on your VPN and backups

SADOS helps businesses across DC, Maryland and Virginia lock down remote access, protect backups and watch for intruders around the clock. If you are not sure whether your firewall is patched or your backups would survive an attack, talk to a SADOS engineer. If you think an attack is already underway, use our emergency IT support line now.