SafePay’s 600-victim campaign spans credentials and vulnerabilities
FBI, CISA and international partners say SafePay has affected at least 600 organizations since August 2024 and was among the most active ransomware groups in 2026. The joint advisory describes victims across businesses and critical-infrastructure sectors in several regions.
SafePay’s documented entry routes include exposed credentials, password guessing, phishing and exploitation of virtual private network (VPN) vulnerabilities. After getting in, operators create or take over accounts, then use familiar system and remote-access tools such as AnyDesk or TeamViewer to move through networks, compress and steal files, and deploy ransomware. Because those tools can resemble routine administration, activity can spread before encryption makes the incident unmistakable.
The exposure is not limited to the vulnerable appliance that may have opened a door: organizations facing credential or phishing attacks can also see intrusions deepen through accounts and trusted remote-access tools. The advisory does not establish which entry route accounts for the most victims.
CVSS 9.8 CRITICAL: a deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code… Known ransomware campaign use. EPSS 90% (100th percentile).
CVSS 7.5 HIGH: vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. Known ransomware campaign use. EPSS 81% (100th percentile).
CISA federal remediation date Sep 12 · date passed
CVSS 7.5 HIGH: a vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower… Known ransomware campaign use. EPSS 72% (99th percentile).
CVSS 5 MEDIUM: a vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco… Known ransomware campaign use. EPSS 25% (98th percentile).
CVSS 9.8 CRITICAL: an improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially… Known ransomware campaign use. EPSS 18% (97th percentile).
CISA federal remediation date Sep 30 · date passed
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.