A ransomware group called SafePay has drawn a joint warning from U.S. and international agencies. CISA, the FBI, the U.S. Secret Service and partner agencies abroad issued a #StopRansomware advisory on the group, and it gives small and midsize firms a clear list of things to check.
The advisory's top actions are patching, especially firewalls and other edge devices, applying Zero Trust, limiting admin tools and rights, and turning on MFA. None of that requires a large security team, but it does require someone to own it this week.
Key facts
- CISA's press release says SafePay has impacted approximately 600 victims across the Americas, Europe and Australia.
- The advisory, AA26-293A, says the group has been highly active since August 2024.
- SafePay actors usually break in by stealing or guessing passwords, exploiting flaws in security systems, or phishing, according to the advisory.
- According to CISA, the group deletes or disables backups, steals data, encrypts systems and threatens to publish stolen files.
- CISA urges offline backups, regular restore tests and network segmentation.
Background
The advisory, numbered AA26-293A, says SafePay actors have impacted at least 600 separate victims across multiple critical infrastructure sectors. Its co-authors include Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the UK's North West Regional Organised Crime Unit.
According to the advisory, SafePay actors typically steal or guess passwords, exploit weak spots in security systems, and send phishing messages. The advisory says the actors have used IP addresses from the VPN provider Mullvad, along with phished accounts, to exploit edge-device flaws CVE-2020-3259 and CVE-2023-20269. Agencies also saw automated scripts exploit CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 on systems exposed to the internet.
Once inside a network, the group leans on normal admin tools. The advisory says SafePay actors use PsExec and Windows Remote Management to run commands on remote machines and often turn off security software. Because those tools are also used by IT staff, the activity can blend in.
The final stage is built to force payment. CISA says the group undermines recovery by deleting or disabling backups, then steals data, encrypts systems and threatens to publish stolen files, in some cases by calling victims directly. The ransom note asks for payment in cryptocurrency, the advisory says.
What it means for you
Small firms often rely on a single firewall or remote-access box at the edge of the network. That device is exactly the kind of target this advisory describes. If it is missing updates, it can become the front door for an attacker.
Passwords matter just as much. A reused or weak password, or one handed over in a phishing email, can give an attacker a working login without any hacking at all. Multi-factor sign-in makes a stolen password far less useful. Our cybersecurity services can help you find weak logins and exposed devices before someone else does.
Backups are the other big concern. CISA warns that SafePay goes after backups to block recovery. If your only backup sits on the same network, a single break-in can wipe out both your files and your copies. Our post on why ransomware can wipe out your backups too explains how that happens. For a sturdier setup, our disaster recovery services focus on copies that stay out of reach and can be restored quickly.
Practical steps
Work through this list with whoever manages your IT:
- Patch edge devices first. The advisory puts patching at the top of its list, with special focus on firewalls and other edge devices.
- Check for the listed flaws. Ask your IT provider whether any system is exposed to CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 or CVE-2024-40766, all named in the advisory.
- Turn on MFA everywhere it is offered. The advisory lists MFA among its key actions.
- Limit admin tools and rights. The advisory says to restrict admin tools and privileges and to apply Zero Trust. Fewer admin accounts mean fewer keys for an attacker to steal.
- Keep offline backups and test them. CISA urges offline backups and regular tests of restoration.
- Split up the network. CISA also recommends network segmentation, so a break-in on one machine does not reach everything.
- Look for signs of a past break-in. CISA's Chris Butera urged organizations to patch the known exploited flaws in the advisory quickly and to run forensic triage to see whether systems were already compromised.
- Use the published indicators. Indicators of compromise are offered as STIX XML and STIX JSON files with the advisory, and your security tools or provider can load them.
Staff training helps too, since phishing is one of the main ways in. Our post on what happens after an employee clicks a bad link walks through the first hour after a bad click. If you lack the time to track updates and alerts, our managed IT services can handle routine patching and monitoring.
What happens next
The full advisory is posted on CISA's site with its indicators of compromise in STIX formats. Firms that use an IT provider should ask them directly whether the advisory's steps are done and whether any of the listed flaws were present.
CISA's release stresses that urgent patching and a check for earlier compromise both matter. Patching closes the door, but it does not remove an attacker who may already be inside.
