CISA, the FBI and agencies from Germany and the UK are warning about SafePay, a ransomware group that has hit at least 600 organisations across Europe, the Americas and Australia. It gets in through VPNs, stolen passwords and unpatched firewalls. If your company has remote access, check patches, MFA and offline backups this week.
The essentials
- Joint advisory AA26-293A was published on 20 October 2026. It is signed by the FBI, CISA, the US Secret Service, the Rhineland-Palatinate criminal police (Germany), the UK's National Crime Agency and the North West Regional Organised Crime Unit.
- SafePay has hit at least 600 organisations since August 2024 and is one of the most active groups of 2026, according to The Record. The real number is higher: it only publishes victims who don't pay.
- It uses automated scripts to exploit five vulnerabilities in edge devices and exposed systems: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
- It encrypts with ChaCha20 and RSA and leaves files with the .SafePay extension. Without the key, they can't be recovered.
- It demands a percentage of the company's revenue in cryptocurrency and phones the victim to apply pressure.
Does this affect me if my company uses a VPN or remote access?
You probably fit its profile. The advisory gives no victim figures for Spain, but SafePay operates in Europe and gets in through doors almost every small business has. According to BleepingComputer and the advisory itself, initial access comes three ways:
- Exposed credentials or passwords guessed by brute force.
- VPN access and vulnerabilities in firewalls and other internet-facing devices.
- Accounts obtained through phishing, used from IP addresses belonging to the VPN provider Mullvad.
If your VPN doesn't ask for a second factor, or your firewall hasn't been updated in months, you are exactly what its scripts are looking for.
What does it do once inside?
It creates new accounts or takes over existing ones. It moves across the network with PsExec, WinRM, RDP and remote management software, disables security protections and sometimes changes users' passwords to lock them out.
To steal data it uses legitimate tools: FileZilla, 7-Zip, RClone, WinRAR, WinSCP and, in some cases, OneDrive. To deploy the ransomware it relies on AnyDesk, TeamViewer and ScreenConnect. None of these tools is malicious in itself, so your antivirus has no particular reason to flag them.
Will my backups save me?
It depends on where they are. SafePay stops the Volume Shadow Copy service and factory-resets NAS devices holding backups. If your backup lives on a NAS reachable from the network with domain credentials, the attacker wipes it before encrypting. Only an offline or immutable copy you have test-restored will save you.
What to do today
- Ask your IT provider or vendor to confirm in writing that firewalls, VPNs and other edge devices are up to date and not affected by any of the five CVEs in the advisory.
- Turn on MFA for the VPN, email and every admin account.
- Check for new accounts or privileges nobody recognises.
- Inventory AnyDesk, TeamViewer, ScreenConnect and any other remote access tool. Uninstall the ones you don't use.
- Confirm you have an offline or immutable backup, that the backup NAS doesn't accept domain credentials, and that someone has done a test restore.
- Warn your staff: a call pressuring them to pay or to contact "the group" is part of the extortion and must be reported straight away.
If you detect an intrusion, isolate the affected machines and report it. In Spain you can call INCIBE's 017 helpline.
What it means for a small business
This advisory contains no new technique. That's the worrying part. SafePay has racked up hundreds of victims with well-known methods: weak passwords, VPNs without a second factor and edge devices with vulnerabilities disclosed years ago. The oldest one in the advisory dates from 2020.
In many small businesses the firewall and VPN get installed once and forgotten. Nobody is assigned to update them. That no-man's-land is what automated scripts exploit: they don't pick you, they pick anyone still unpatched.
Our view: before buying another tool, close the doors in the list above. They're cheap and can be verified in days. And assume the attacker will use legitimate software you already have installed, so cut down what's there and watch who uses it.
On paying, CISA is clear: paying doesn't guarantee you get your files back. Your plan B has to be a backup the attacker can't touch, not the hope of negotiating. If you want a second opinion on your perimeter, here's how we work in cybersecurity.
Frequently asked questions
Are there SafePay victims in Spain?
The advisory gives no figures by country. It does confirm the group operates in Europe and that the real number of victims is higher than the ones it publishes.
Can I recover my files without paying?
Not without the key: the encryption combines ChaCha20 and RSA. The realistic route is restoring from an offline or immutable backup.
What should I do if someone calls demanding the ransom?
Don't negotiate on your own. Report it immediately, isolate the affected machines and file a complaint. Paying doesn't guarantee you get your data back.
