FBI, CISA detail SafePay ransomware: 600+ victims since 2024

The FBI, CISA and international partners published a joint #StopRansomware advisory on 20 October 2026 documenting SafePay, which it calls one of the most active ransomware operations of 2026 with at least 600 victims since August 2024. The advisory — AA26-293A — ships the exploited CVEs, TTPs and a full indicator set, which is what makes it worth acting on rather than just reading.

The authoring agencies are the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit. Victims span North America, South America, Europe and Australia across multiple critical-infrastructure sectors; the indicators were observed between November 2024 and August 2026.

How SafePay gets in

The advisory names five exploited vulnerabilities. Patch status against these is the first triage question:

• CVE-2020-3259 and CVE-2023-20269 — exploited against edge devices, with phished account profiles then used for network access.
• CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 — exploited across internet-exposed systems via automated scanning scripts.

Beyond CVEs, the advisory lists brute-force password attacks (T1110), VPN exploitation (T1133) including logins from Mullvad VPN IP addresses, phishing, and exploitation of public-facing applications (T1190). Operators use legitimate remote tools — AnyDesk, TeamViewer, ScreenConnect — to move ransomware onto hosts, exfiltrate with RClone, WinRAR and FileZilla, and apply phone-call pressure to victims. Encrypted files are appended with .SafePay, and the ransom note directs victims to a TOR chat portal. The agencies note parts of SafePay's code resemble the largely defunct LockBit.

Named victims

The advisory does not name victims, but Recorded Future ties SafePay to IT distributor Ingram Micro, UK telematics firm Microlise, and government-services contractor Conduent — whose incident disrupted Medicaid, child-support and food-assistance processing and led to an $80 million class-action settlement.

Indicators of compromise

A subset, verbatim from AA26-293A (verify IPs before blocking — the advisory flags some tooling as dual-use):

# SHA-256 (selected)
921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae  soc.dll
327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917  locker.dll (PE32)
BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41  SharpShares.exe

# IP addresses (defanged as published)
88.119.167[.]239   # soc.dll command and control
5.255.11[.]134     # exfiltration
37.10.71[.]188     # exfiltration

# Encrypted file extension
.SafePay

Action checklist

1. Confirm the five exploited CVEs above are patched on every edge device and internet-exposed system — all five predate 2025 and remain unpatched often enough to make an advisory in 2026.
2. Enforce MFA on webmail, VPNs and all critical-system accounts — stolen and brute-forced credentials are SafePay's primary entry path.
3. Hunt for the IOCs above and for the advisory's full list (filenames such as locker.dll, netscan.exe, SharpShares.exe; the .SafePay extension).
4. Maintain encrypted, immutable, offline backups and test restoration — the group exfiltrates before encrypting, so backups alone do not neutralise the extortion.
5. Audit admin accounts, segment networks, and restrict unknown remote-access tools (AnyDesk, TeamViewer, ScreenConnect) at the perimeter.

Context

This is the second time this quarter that German state police have shared billing on a ransomware takedown or advisory alongside the FBI — following the Qilin core-member arrest we covered earlier. The cross-border pattern is becoming the norm for high-volume operations whose victims and infrastructure straddle the Atlantic. The five exploited CVEs are the actionable core: none are new, all are patchable today.