SafePay Ransomware Wipes Backups First
SafePay ransomware has compromised at least 600 organizations since August 2024, and a joint advisory published on October 20 says its operators halt shadow copies and reset backup storage before they encrypt anything. The FBI, CISA and the US Secret Service wrote it together with Germany’s Landeskriminalamt Rheinland-Pfalz and UK law enforcement (the National Crime Agency and the North West Regional Organised Crime Unit). The group gets in through old, known flaws in firewalls and backup software.
What Happened
The advisory (AA26-293A) covers SafePay activity across critical infrastructure in North America, South America, Europe and Australia, based on investigations through August 2026. Initial access comes from exposed credentials, phishing, brute force and vulnerable internet-facing systems. Investigators saw SafePay use Mullvad VPN addresses together with phished account profiles to exploit the two Cisco flaws below; the other three were exploited with automated scripts against internet-exposed systems.
Inside the network, the operators create or take over administrator accounts, move with PsExec, Windows Remote Management and Remote Desktop, list network shares with ShareFinder.ps1 and SharpShares.exe, and switch off security software. They copy data out with WinSCP and RClone, in some cases to Backblaze B2, and use AnyDesk and TeamViewer for remote access. Then comes the step that matters most for recovery: they stop the Volume Shadow Copy Service and reset network attached storage that holds backups to factory settings. In some cases it deleted all network-attached backups of company data. Files are encrypted with ChaCha20 and RSA and get the .SafePay extension. Ransom demands are tied to a share of the victim’s revenue, and the operators phone victims to add pressure.
Five vulnerabilities are named as entry points: CVE-2020-3259 and CVE-2023-20269 (Cisco), CVE-2023-27532 and CVE-2024-40711 (Veeam) and CVE-2024-40766 (SonicWall SonicOS).
Why It Matters
Every one of the five flaws is at least two years old and has a vendor fix. The group does not need zero-days. Unpatched edge devices and backup servers do the job, along with backups that the same administrator account can reach. Once an attacker holds that account, the backup is one more file share to wipe.
Assumption: for DACH mid-sized companies the exposure is the same firewall-plus-Veeam-plus-NAS pattern, often run by a small IT team. We found no BSI warning for this advisory as of October 21 (search result, not proof). The recovery question is a governance one: if the only restore path can be deleted with a domain admin password, the board has no recovery guarantee, only a copy that looks like one.
What You Should Do Now
- Close the five entry points. Check every internet-facing Cisco, SonicWall and Veeam system against the five CVE IDs above, patch or retire what is affected, and enforce multifactor authentication on VPN, firewall and backup administration.
- Make one backup copy unreachable. Keep an offline or immutable copy outside the domain, with separate credentials, and restrict NAS and backup administration to dedicated accounts. Run a full restore test this quarter and time it.
- Hunt for the preparation steps. Alert on stopped Volume Shadow Copy services, new administrator accounts, remote access tools nobody installed, RClone or WinSCP activity and large outbound transfers to cloud storage. Check legitimate tools against context before blocking, as the advisory itself advises.
- If you find an intrusion, isolate the affected hosts, preserve evidence, scope every compromised account and plan the eviction before you restore.
DIESEC Perspective
Ransomware recovery is decided before the attack, by where the backups sit and who can delete them. Treat backup infrastructure as a primary target in every risk assessment, because the attackers already do.
Not sure whether your backups would survive a domain admin compromise? Contact DIESEC for a ransomware readiness review that includes a backup destruction scenario.
Sources: CISA AA26-293A | GBHackers
Published: 2026-10-22 | Category: Ransomware & Extortion | ~4 min read
