SafePay Ransomware Hit 600+ Critical Infrastructure Orgs and Destroyed Their Backups

SafePay follows a consistent six-phase attack chain that the FBI has documented across all 600 confirmed intrusions. The consistency is a product of the group's non-RaaS structure: because a single operator team executes every intrusion, the playbook stays tightly standardized.

Phase one is initial access through Mullvad-masked IP addresses. SafePay brute-forces VPN login portals or replays phished credentials while routing traffic through Mullvad commercial VPN exit nodes to mask source attribution. Simultaneously or as an alternative, automated scripts exploit CVE-2023-27532 and CVE-2024-40711 against Veeam Backup servers and CVE-2020-3259, CVE-2023-20269, and CVE-2024-40766 against Cisco ASA and SonicWall devices.

Phase two is privilege escalation and persistence. Operators gain administrative rights on existing accounts or create new admin accounts directly. They use a UAC bypass technique (T1548.002) that spawns elevated processes through Component Object Model, enabling arbitrary command execution without triggering standard UAC prompts.

Phase three is reconnaissance and lateral movement using PsExec, WinRM, and RDP. ShareFinder.ps1 scans every Active Directory-joined host for accessible file shares. SharpShares.exe supplements this with network-level share enumeration. Mimikatz and dcsync.exe extract domain credentials and Kerberos tickets.

Phase four is data exfiltration. Files are staged with 7-Zip or WinRAR into compressed archives, then moved via Rclone to actor-controlled cloud accounts or via FileZilla to attacker FTP servers. Some intrusions used OneDrive as the exfiltration channel, abusing the legitimate Microsoft service to avoid detection by egress filters watching for known malicious destinations.

Phase five is backup destruction. Operators halt the Volume Shadow Copy Service, delete all shadow copies, factory-reset NAS backup devices, and terminate backup software agent processes before the encryption payload runs.

Phase six is encryption and extortion. ChaCha20 encrypts file content; RSA protects the per-victim key. Files receive the .safepay extension. readme_safepay.txt lands on the desktop. SafePay calls victims by phone if they do not initiate contact through the TOR portal.

CISA advisory AA26-293A documents SafePay activity through August 2026 across victims in North America, South America, Europe, and Australia. The 600+ figure represents confirmed unique victims, not ransom demands: SafePay's leak site has listed additional organizations not captured in law enforcement investigation records.

Critical infrastructure sectors are disproportionately represented. Manufacturing, healthcare, financial services, government agencies, and energy companies appear most frequently in FBI case files. Ingram Micro, one of the world's largest IT and logistics distributors, publicly disclosed a SafePay-related outage, indicating the group attacks enterprise targets with supply chain reach.

The backup destruction component elevates SafePay's impact above typical ransomware operators. Standard ransomware recovery timelines range from days to weeks when organizations have clean backups. SafePay-hit organizations without offline, air-gapped backups face complete data loss or ransom payment as the only recovery paths. The factory-reset of NAS devices is particularly destructive because it cannot be reversed without a secondary offline copy.

Double extortion adds a regulatory and reputational layer. Data exfiltrated before encryption is posted to SafePay's leak site if victims do not pay. For healthcare and financial organizations subject to HIPAA, PCI-DSS, or GDPR, the data exposure triggers mandatory breach notifications regardless of whether ransom is paid.

The FBI has assessed SafePay as among the most active ransomware groups operating in 2026. The combination of consistent TTPs, high victim volume, backup destruction, and non-affiliate structure makes it operationally distinct from the larger but noisier RaaS ecosystems.

CISA advisory AA26-293A provides nine IP addresses, multiple malicious files, and key behavioral artifacts observed across SafePay intrusions from November 2024 through August 2026. Block the following IPs at the perimeter firewall and add them to your SIEM blocklist before hunting. The advisory recommends verifying each IP through your own telemetry before blocking, as some were observed on shared infrastructure.

Two generated rules target SafePay's most distinctive behaviors: the shadow copy deletion sequence that precedes encryption, and the DCSync credential harvesting used during privilege escalation. Both carry experimental status; validate against your environment before enabling automated blocking to reduce false positives from legitimate administrative activity.

CISA advisory AA26-293A provides a prioritized mitigation list. Apply these steps in order; the first three are doable within four hours without a change window. For detailed guidance on any step, see the full advisory at cisa.gov/news-events/cybersecurity-advisories/aa26-293a.

SafePay's ability to destroy backups before encryption means organizations without offline copies face complete data loss if these steps are not in place before an intrusion completes. The backup isolation step, while listed last, is operationally as urgent as the patch steps for any organization that has not already implemented it.

See also: Warlock Ransomware Exploits SharePoint for Critical Infrastructure Attacks for parallel ransomware patterns and Qilin Ransomware GlobalProtect Campaign Analysis for additional VPN exploitation context.

The CISA/FBI advisory was released yesterday, October 20, which means security teams that saw it overnight are still in the response window. SafePay has maintained a consistently high operational tempo since August 2024, with FBI investigations documenting active intrusions through August 2026. The group has not shown any signs of winding down operations.

Three factors make SafePay structurally more damaging than typical ransomware operators. First, the non-RaaS model means consistent, professional execution without the quality variance seen in affiliate-based programs. Second, the backup destruction routine is systematic and thorough: shadow copies, NAS devices, and backup agent processes are all targeted, not just one. Third, the group uses double extortion, posting stolen data publicly if victims do not pay.

The five CVEs in the advisory are all patchable. None require zero-day response protocols; they are known vulnerabilities on the CISA KEV catalog with available patches. The IOC IP addresses are specific and blockable. The behavioral indicators are detectable with standard SIEM or EDR queries. SafePay's 600+ victim count reflects organizations that had these gaps in place before the intrusion, not a technically sophisticated bypass of well-maintained defenses.

This is an execution problem, not a detection problem. The tools to stop SafePay exist; the question is whether they have been deployed. Defenders should treat this advisory the same way they would treat a CISA emergency directive: patch the CVEs, block the IPs, and verify backup isolation today.