# #StopRansomware: SafePay Ransomware (CISA AA26-293A) — Exploitation of Cisco ASA/FTD, Veeam B&R and SonicWall SonicOS

> A joint FBI/CISA/USSS/German LKA Rheinland-Pfalz/UK NCA advisory describes SafePay, a ransomware group active since August 2024 that has impacted at least 600 victims across critical infrastructure in North America, South America, Europe and Australia. Actors gain access through VPN/edge-device exploitation and credential abuse, exfiltrate data, then encrypt with a ChaCha20/RSA hybrid scheme and demand cryptocurrency.

- **Published:** 2026-10-20T18:48:33Z
- **Last reviewed:** 2026-10-20T22:35:58.222Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3978
- **ID:** TL-2026-3978
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Safepay
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766

## Description

CISA, the FBI, USSS, the German Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit published advisory AA26-293A on 2026-10-20. It reports that SafePay has been highly active since August 2024, has impacted at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe and Australia, and ranked among the most active ransomware groups of 2026. The advisory's IOC observation window runs from November 2024 to August 2026.

Initial access is obtained through external remote services (VPN) and exploitation of public-facing applications. The advisory lists five exploited CVEs: CVE-2020-3259 (information exposure), CVE-2023-20269 (authentication bypass via alternate path), CVE-2023-27532 (missing authentication), CVE-2024-40711 (deserialization of untrusted data) and CVE-2024-40766 (improper access control). The advisory text does not name vendors; per NVD, these map to Cisco ASA/FTD (CVE-2020-3259, CVE-2023-20269), Veeam Backup & Replication (CVE-2023-27532, CVE-2024-40711) and SonicWall SonicOS (CVE-2024-40766). Credential theft, phishing and brute-force attacks are also used. Third-party reporting (Quorum Cyber) similarly points to compromised VPN gateway credentials as a primary vector.

After access, actors execute via PowerShell and Windows Command Shell, run tools remotely with PsExec, create or modify accounts for persistence, bypass UAC and impersonate tokens to escalate, and use packed binaries, file deletion, system-binary proxy execution and disabling of security tools for defense evasion. Credentials are harvested with Mimikatz and a DCSync tool (dcsync.exe); discovery uses ShareFinder.ps1, SharpShares.exe, netscan.exe, NetExec (nxc.exe) and nltest. Lateral movement uses RDP, SMB/admin shares and WinRM. Remote access tools (ScreenConnect, AnyDesk, TeamViewer) provide persistent access. A SOCKS proxy tool and a soc.dll component with an associated C2 IP (88.119.167.239) were documented, and analysis noted RunPE-bundled and injected PE payloads.

Data is archived with 7-Zip or WinRAR and exfiltrated using RClone, FileZilla, WinSCP, the Backblaze B2 CLI (b2.exe) or OneDrive. The ransomware (locker.dll / 1.exe) uses a ChaCha20 stream cipher with RSA public-key encryption and appends the .SafePay extension. System recovery is inhibited, and Acronis Disk Director-named binaries appear in the file IOCs. Ransom notes direct victims to a TOR .onion site with a victim ID login; actors also pressure victims by phone and publish data of non-paying victims on a leak site.

The advisory states no CVSS score and no nation-state attribution; SafePay is treated as a financially motivated criminal group. Severity CRITICAL is the analyst's assessment based on scale and critical-infrastructure impact. Several IPs in the advisory (e.g. 104.26.2.223, 140.82.114.4, 185.199.108.133, 173.194.194.94) fall in ranges commonly associated with shared CDN/hosting providers, so they should be matched with context rather than blocked blindly. BeaconBeagle returned no data (HTTP 404) for 88.119.167.239 and 37.10.71.188.

## MITRE ATT&CK

- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1569.002 System Services: Service Execution
- T1098 Account Manipulation
- T1136 Create Account
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1027.002 Obfuscated Files or Information: Software Packing
- T1070.004 Indicator Removal: File Deletion
- T1218 System Binary Proxy Execution
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1110 Brute Force
- T1003 OS Credential Dumping
- T1003.006 OS Credential Dumping: DCSync
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1021.006 Remote Services: Windows Remote Management
- T1560.001 Archive Collected Data: Archive via Utility
- T1219 Remote Access Tools
- T1048 Exfiltration Over Alternative Protocol
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [CISA Advisory AA26-293A: #StopRansomware: SafePay Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a)
- [NVD: CVE-2024-40766 (SonicWall SonicOS)](https://nvd.nist.gov/vuln/detail/CVE-2024-40766)
- [NVD: CVE-2024-40711 (Veeam Backup & Replication)](https://nvd.nist.gov/vuln/detail/CVE-2024-40711)
- [NVD: CVE-2023-27532 (Veeam Backup & Replication)](https://nvd.nist.gov/vuln/detail/CVE-2023-27532)
- [NVD: CVE-2023-20269 (Cisco ASA/FTD)](https://nvd.nist.gov/vuln/detail/CVE-2023-20269)
- [NVD: CVE-2020-3259 (Cisco ASA/FTD)](https://nvd.nist.gov/vuln/detail/CVE-2020-3259)
- [Quorum Cyber: SafePay Ransomware Report](https://www.quorumcyber.com/malware-reports/safepay-ransomware-report/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [StopRansomware.gov](https://www.stopransomware.gov/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3978