Threat reportRansomwareTL-2026-3978
#StopRansomware: SafePay Ransomware (CISA AA26-293A) — Exploitation of Cisco ASA/FTD, Veeam B&R and SonicWall SonicOS
#StopRansomware (TL-2026-3978), also tracked as SafePay, is a critical-severity ransomware operation, first published 2026-10-20. It is attributed to Safepay with high confidence, affects Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense, references 5 CVEs (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532), maps to 28 MITRE ATT&CK techniques (T1003, T1003.006, T1018), and is covered by 9 detection rules and 32 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 28MITRE ATT&CK
- Actors
- 1Safepay
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 32Indicators of compromise
Key facts for TL-2026-3978
- Threat ID
- TL-2026-3978
- Also known as
- SafePay, AA26-293A
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Safepay
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- critical infrastructure, manufacturing, technology, managed service providers, government administration, private sector
- Target regions
- North America, 005 - South America, Europe, australia
- Detection rules
- 9
- Indicators of compromise
- 32
- Updates
- 2026-10-20 · revalidated 1× · latest source
Malware and tooling in #StopRansomware
Malware and tooling: AnyDesk, MimiKatz, STOP Ransomware, safepay, PSEXEC, Rclone - S1040, ScreenConnect, WinSCP
How #StopRansomware works
A joint FBI/CISA/USSS/German LKA Rheinland-Pfalz/UK NCA advisory describes SafePay, a ransomware group active since August 2024 that has impacted at least 600 victims across critical infrastructure in North America, South America, Europe and Australia. Actors gain access through VPN/edge-device exploitation and credential abuse, exfiltrate data, then encrypt with a ChaCha20/RSA hybrid scheme and demand cryptocurrency.
CISA, the FBI, USSS, the German Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit published advisory AA26-293A on 2026-10-20. It reports that SafePay has been highly active since August 2024, has impacted at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe and Australia, and ranked among the most active ransomware groups of 2026. The advisory's IOC observation window runs from November 2024 to August 2026.
Initial access is obtained through external remote services (VPN) and exploitation of public-facing applications. The advisory lists five exploited CVEs: CVE-2020-3259 (information exposure), CVE-2023-20269 (authentication bypass via alternate path), CVE-2023-27532 (missing authentication), CVE-2024-40711 (deserialization of untrusted data) and CVE-2024-40766 (improper access control). The advisory text does not name vendors; per NVD, these map to Cisco ASA/FTD (CVE-2020-3259, CVE-2023-20269), Veeam Backup & Replication (CVE-2023-27532, CVE-2024-40711) and SonicWall SonicOS (CVE-2024-40766). Credential theft, phishing and brute-force attacks are also used. Third-party reporting (Quorum Cyber) similarly points to compromised VPN gateway credentials as a primary vector.
After access, actors execute via PowerShell and Windows Command Shell, run tools remotely with PsExec, create or modify accounts for persistence, bypass UAC and impersonate tokens to escalate, and use packed binaries, file deletion, system-binary proxy execution and disabling of security tools for defense evasion. Credentials are harvested with Mimikatz and a DCSync tool (dcsync.exe); discovery uses ShareFinder.ps1, SharpShares.exe, netscan.exe, NetExec (nxc.exe) and nltest. Lateral movement uses RDP, SMB/admin shares and WinRM. Remote access tools (ScreenConnect, AnyDesk, TeamViewer) provide persistent access. A SOCKS proxy tool and a soc.dll component with an associated C2 IP (88.119.167.239) were documented, and analysis noted RunPE-bundled and injected PE payloads.
Data is archived with 7-Zip or WinRAR and exfiltrated using RClone, FileZilla, WinSCP, the Backblaze B2 CLI (b2.exe) or OneDrive. The ransomware (locker.dll / 1.exe) uses a ChaCha20 stream cipher with RSA public-key encryption and appends the .SafePay extension. System recovery is inhibited, and Acronis Disk Director-named binaries appear in the file IOCs. Ransom notes direct victims to a TOR .onion site with a victim ID login; actors also pressure victims by phone and publish data of non-paying victims on a leak site.
The advisory states no CVSS score and no nation-state attribution; SafePay is treated as a financially motivated criminal group. Severity CRITICAL is the analyst's assessment based on scale and critical-infrastructure impact. Several IPs in the advisory (e.g. 104.26.2.223, 140.82.114.4, 185.199.108.133, 173.194.194.94) fall in ranges commonly associated with shared CDN/hosting providers, so they should be matched with context rather than blocked blindly. BeaconBeagle returned no data (HTTP 404) for 88.119.167.239 and 37.10.71.188.
MITRE ATT&CK techniques used in TL-2026-3978
Credential Access
T1003 OS Credential Dumping; T1003.006 OS Credential Dumping: DCSync; T1110 Brute Force
Discovery
T1018 Remote System Discovery; T1135 Network Share Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.006 Remote Services: Windows Remote Management
Defense Evasion
T1027.002 Obfuscated Files or Information: Software Packing; T1055 Process Injection; T1070.004 Indicator Removal: File Deletion; T1218 System Binary Proxy Execution
Exfiltration
T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1569.002 System Services: Service Execution
Persistence
T1098 Account Manipulation; T1136 Create Account
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Privilege Escalation
T1134.001 Access Token Manipulation: Token Impersonation/Theft; T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
Command and Control
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
Collection
T1560.001 Archive Collected Data: Archive via Utility
defense-impairment
Affected products and versions in #StopRansomware
- Cisco — Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
Vulnerable versions: CVE-2020-3259: ASA 9.8-9.13, FTD 6.2.3-6.5.0; CVE-2023-20269: ASA 9.8.1 through 9.19.1.18, FTD 6.2.3 through 7.4.0
Fixed in: CVE-2020-3259: ASA 9.8.4.20+, 9.9.2.67+, 9.10.1.40+, 9.12.3.9+, 9.13.1.10+; FTD 6.2.3.16+, 6.3.0.6+, 6.4.0.9+, 6.5.0.5+ - Veeam — Backup & Replication
Vulnerable versions: CVE-2023-27532: v11 before 11.0.1.1261 P20230227; v12.0.0.1420 before P20230223; CVE-2024-40711: 12.0.0.1420 through 12.2.0.333
Fixed in: 11a build 11.0.1.1261 P20230227; 12 build 12.0.0.1420 P20230223; 12.2.0.334 and later - SonicWall — SonicOS
Vulnerable versions: Gen 5 5.9.2.14-12o and older; Gen 6 6.5.4.14-109n and older; Gen 7 7.0.1-5035 and older
Fixed in: Gen 5 5.9.2.14-13o and later; Gen 6 6.5.4.15.116n and later; Gen 7 later than 7.0.1-5035 - Microsoft — Windows (ransomware target platform; domain-joined servers and workstations)
Vulnerable versions: Not version-specific
Remediation for #StopRansomware
Patches
- Cisco ASA/FTD fixes per Cisco advisories (e.g. ASA 9.8.4.20+, 9.12.3.9+, 9.13.1.10+ for CVE-2020-3259)
- Veeam Backup & Replication 12.2.0.334 or later (CVE-2024-40711); 11a build 11.0.1.1261 P20230227 / 12 build 12.0.0.1420 P20230223 or later (CVE-2023-27532)
- SonicWall SonicOS Gen 5 5.9.2.14-13o+, Gen 6 6.5.4.15.116n+, Gen 7 later than 7.0.1-5035 (CVE-2024-40766)
Immediate actions
- Prioritize patching known exploited vulnerabilities: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766
- Hunt for the advisory IOCs (IPs, hostnames, filenames, hashes) and the .SafePay extension
- Review domain controllers and servers for unauthorized or unrecognized accounts
- Enforce MFA on VPN, remote access and all externally exposed services
Workarounds
- Restrict management and VPN interfaces from internet exposure where patching is delayed
- Block or alert on unapproved remote access tools (AnyDesk, ScreenConnect, TeamViewer) and exfiltration tools (RClone, b2.exe)
Longer-term hardening
- Maintain offline, encrypted, immutable backups and test restoration regularly
- Segment networks to restrict lateral movement
- Apply least privilege and audit administrative accounts
- Deploy network monitoring and EDR with behavioral detection
- Restrict command-line and scripting use and filter traffic to remote services
- Enforce 15-64 character passwords per NIST guidance without frequent forced resets
CVEs associated with #StopRansomware
CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766
Weaknesses (CWE) in #StopRansomware
Timeline of #StopRansomware
- CVE-2020-3259 (Cisco ASA/FTD information exposure) published; later listed among SafePay-exploited CVEs.
- CVE-2023-27532 (Veeam Backup & Replication missing authentication) published.
- CVE-2023-20269 (Cisco ASA/FTD authentication bypass via alternate path) published.
- SafePay operations commence (August 2024, month-level date per CISA); Quorum Cyber places first confirmed activity in September 2024.
- CVE-2024-40766 (SonicWall SonicOS improper access control) published.
- CVE-2024-40711 (Veeam Backup & Replication deserialization RCE) published.
- Start of the November 2024 to August 2026 window in which advisory IOCs were observed (month-level date).
- Quorum Cyber reports peak activity in March 2025, with 43 confirmed victims and SafePay as the 4th most active group (month-level date).
- End of the advisory IOC observation window (August 2026, month-level date); SafePay ranked among the most active ransomware groups of 2026.
- FBI, CISA, USSS, German LKA Rheinland-Pfalz and UK NCA publish joint advisory AA26-293A reporting at least 600 SafePay victims.
Update history for TL-2026-3978
- 2026-10-20 — SafePay Ransomware Among Most Active Groups in 2026 — 600+ Victims, Joint FBI/CISA/USSS/German/UK Advisory (AA26-293A): What changed No severity, exploitability, status or attribution-confidence change. The newer report rates severity HIGH and attribution MEDIUM, which is below the existing CRITICAL and HIGH. Downgrades are never applied, so the existing val
Sources cited for #StopRansomware
- CISA Advisory AA26-293A: #StopRansomware: SafePay Ransomware
- NVD: CVE-2024-40766 (SonicWall SonicOS)
- NVD: CVE-2024-40711 (Veeam Backup & Replication)
- NVD: CVE-2023-27532 (Veeam Backup & Replication)
- NVD: CVE-2023-20269 (Cisco ASA/FTD)
- NVD: CVE-2020-3259 (Cisco ASA/FTD)
- Quorum Cyber: SafePay Ransomware Report
- CISA Known Exploited Vulnerabilities Catalog
- StopRansomware.gov
Detection coverage for TL-2026-3978
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3978 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.