SafePay Ransomware Surges: 600+ Organizations Hit Since August 2024
A joint cybersecurity advisory issued on October 20, 2024, by the FBI, CISA, U.S. Secret Service, and international partners warns of a sharp rise in SafePay ransomware attacks, which have compromised at least 600 organizations across North America, South America, Europe, and Australia since August 2024. The group has emerged as one of the most active ransomware threats, targeting critical infrastructure sectors and businesses with a double-extortion strategy stealing data before encrypting files and threatening to leak it if ransom demands go unmet.
How SafePay Gains Access
Investigators identified multiple initial-access vectors, including:
- Exposed credentials and brute-force attacks on weak passwords.
- Phishing campaigns to compromise user accounts.
- Exploitation of unpatched vulnerabilities in VPNs, firewalls, and backup systems, including:
- Cisco ASA/FTD (CVE-2020-3259, CVE-2023-20269)
- Veeam Backup & Replication (CVE-2023-27532, CVE-2024-40711)
- SonicWall SonicOS (CVE-2024-40766)
SafePay operators have also been linked to Mullvad VPN-associated IP addresses, though the VPN service itself was not breached. Once inside a network, attackers use legitimate administrative tools to move laterally, disable backups, and delete Windows shadow copies, complicating recovery efforts.
Impact and Mitigation
The advisory highlights familiar security gaps such as unpatched systems, weak credentials, and excessive administrative privileges that enable SafePay’s attacks. The group’s tactics include:
- Disabling recovery systems by resetting network-attached storage (NAS) devices and erasing backups.
- Exfiltrating sensitive data before encryption to pressure victims into paying ransoms.
Authorities urge organizations to:
- Patch known vulnerabilities in VPNs, firewalls, and backup software.
- Enforce multifactor authentication (MFA) and limit privileged access.
- Isolate and test backups to prevent tampering.
The advisory includes indicators of compromise (IOCs) and detection guidance to help security teams identify and respond to SafePay activity. With 600+ victims in just three months, the campaign underscores the risks of unaddressed security weaknesses in enterprise networks.
Source: https://www.esecurityplanet.com/threats/news-fbi-safepay-ransomware-600-organizations/
Veeam TPRM report: https://www.rankiteo.com/company/veeam-software
SonicWall TPRM report: https://www.rankiteo.com/company/sonicwall
"id": "veeson1792636082",
"linkid": "veeam-software, sonicwall",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '600+ organizations',
'location': ['North America',
'South America',
'Europe',
'Australia'],
'type': ['Critical infrastructure sectors',
'Businesses']}],
'attack_vector': ['Exposed credentials',
'Brute-force attacks',
'Phishing campaigns',
'Exploitation of unpatched vulnerabilities'],
'data_breach': {'data_encryption': True,
'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'High (personally identifiable '
'information, payment data possible)',
'type_of_data_compromised': 'Sensitive data'},
'date_detected': '2024-08-01',
'date_publicly_disclosed': '2024-10-20',
'description': 'A joint cybersecurity advisory issued on October 20, 2024, by '
'the FBI, CISA, U.S. Secret Service, and international '
'partners warns of a sharp rise in SafePay ransomware attacks, '
'which have compromised at least 600 organizations across '
'North America, South America, Europe, and Australia since '
'August 2024. The group targets critical infrastructure '
'sectors and businesses with a double-extortion strategy, '
'stealing data before encrypting files and threatening to leak '
'it if ransom demands go unmet.',
'impact': {'data_compromised': 'Sensitive data exfiltrated before encryption',
'identity_theft_risk': 'High (due to data exfiltration)',
'operational_impact': 'Disabling of recovery systems, deletion of '
'Windows shadow copies',
'payment_information_risk': 'High (if payment data was '
'compromised)',
'systems_affected': ['VPNs',
'Firewalls',
'Backup systems',
'NAS devices']},
'initial_access_broker': {'entry_point': ['Exposed credentials',
'Phishing campaigns',
'Unpatched vulnerabilities']},
'investigation_status': 'Ongoing',
'lessons_learned': 'Unpatched systems, weak credentials, and excessive '
'administrative privileges enable ransomware attacks. '
'Backups must be isolated and tested to prevent tampering.',
'motivation': 'Financial gain (ransom payments), data extortion',
'post_incident_analysis': {'corrective_actions': ['Patch vulnerabilities',
'Enforce MFA',
'Limit privileged access',
'Isolate backups'],
'root_causes': ['Unpatched systems',
'Weak credentials',
'Excessive administrative '
'privileges']},
'ransomware': {'data_encryption': True,
'data_exfiltration': True,
'ransomware_strain': 'SafePay'},
'recommendations': ['Patch known vulnerabilities in VPNs, firewalls, and '
'backup software.',
'Enforce multifactor authentication (MFA) and limit '
'privileged access.',
'Isolate and test backups to prevent tampering.',
'Monitor for indicators of compromise (IOCs) provided in '
'the advisory.'],
'references': [{'date_accessed': '2024-10-20',
'source': 'Joint cybersecurity advisory by FBI, CISA, U.S. '
'Secret Service, and international partners'}],
'response': {'law_enforcement_notified': 'FBI, CISA, U.S. Secret Service, '
'international partners',
'remediation_measures': ['Patch known vulnerabilities',
'Enforce MFA',
'Limit privileged access',
'Isolate and test backups']},
'stakeholder_advisories': 'Includes indicators of compromise (IOCs) and '
'detection guidance for security teams.',
'threat_actor': 'SafePay ransomware group',
'title': 'SafePay Ransomware Surge: 600+ Organizations Hit Since August 2024',
'type': 'Ransomware',
'vulnerability_exploited': ['CVE-2020-3259',
'CVE-2023-20269',
'CVE-2023-27532',
'CVE-2024-40711',
'CVE-2024-40766']}