U.S., German and U.K. agencies have issued a joint warning about a ransomware group called SafePay, and their advisory says the group typically gets in through stolen or guessed passwords, known flaws and phishing. CISA, the FBI, the U.S. Secret Service and German and U.K. law enforcement released the #StopRansomware advisory on October 20, 2026.
The good news for small and midsize firms is that the defenses the agencies list are familiar ones. Strong passwords, multifactor sign-in, fast patching and backups that attackers cannot reach do most of the work. This guide walks through what the advisory describes and what a business can do about it this week.
Key facts
- SafePay has been active since August 2024, going after businesses and critical infrastructure in North America, South America, Europe and Australia.
- The agencies say the group has hit at least 600 separate victims and ranked among the most active ransomware groups in 2026.
- Its usual ways in are stolen or guessed passwords, flaws in security systems and phishing.
- The actors wipe out recovery options by stopping shadow copies and resetting backup storage before they encrypt files.
- The agencies do not encourage paying a ransom, since payment does not guarantee files come back.
Background
The advisory lays out how a typical SafePay attack unfolds, from the first login to the ransom demand. Knowing the steps helps a business see where each defense fits.
How they get in
According to the agencies, SafePay actors run brute-force password attacks and abuse VPN access, using IP addresses of the VPN provider Mullvad. They also exploit known software flaws. The advisory names five of them: CVE-2020-3259 and CVE-2023-20269 on edge devices, plus CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 on systems exposed to the internet.
What they do once inside
After the first foothold, the actors work to gain administrator rights and turn off security software. They then move from machine to machine with normal admin tools such as PsExec, WinRM, AnyDesk and TeamViewer, as the advisory explains. Because these tools are legitimate, their use can look like routine IT work.
Before locking anything, the group copies data out. The agencies say it uses tools such as RClone, FileZilla and WinRAR, and sometimes sends the stolen files to OneDrive.
How they block recovery
This step is the one that hurts most. The actors stop the Volume Shadow Copy Service and reset network-attached storage that holds backups to its factory settings. The ransomware itself mixes ChaCha20 and RSA encryption, and the advisory says the locked data cannot be restored without the decryption key.
The pressure then shifts to the victim. The advisory says SafePay demands payment in cryptocurrency, calls victims by phone to pressure them and publishes the stolen data online when they do not pay. Backups stored on the same network are not safe from this kind of attack, a point covered in why ransomware can wipe out your backups too.
What it means for you
The advisory suggests that any organization with internet-facing VPNs or edge devices, weak passwords or no multifactor sign-in fits the pattern SafePay looks for. That describes a lot of small offices, branch sites and remote teams.
The attack does not depend on rare or costly tricks. It leans on gaps that are common and fixable: a reused password, a firewall that has not been updated, an old account with too much access. Closing those gaps raises the cost for an attacker and lowers the chance of a long outage.
Basic antivirus alone does not stop a group that turns security tools off and uses normal admin software to move around. That limit is explained in why the antivirus on your work computers is not enough. A layered plan that pairs monitoring with tight access control does far more, and a review of cybersecurity solutions can show where the holes are.
Practical steps
The agencies and the StopRansomware.gov site point to a short list of defenses. Most can start right away.
- Turn on multifactor sign-in everywhere you can. The advisory asks for MFA on all services where possible, with webmail, VPNs and accounts that reach critical systems first in line.
- Use long passwords and stop forced resets. Following NIST guidance, the agencies recommend passwords of at least 15 characters and no required changes more than once per year.
- Patch known exploited flaws first. The advisory says to put those patches at the top of the list and keep operating systems, software and firmware current.
- Scan what faces the internet. StopRansomware.gov advises regular vulnerability scans, with extra focus on internet-facing devices.
- Limit admin power. The agencies recommend time-based, just-in-time admin access and least privilege for admin accounts.
- Keep backups offline and test them. StopRansomware.gov says to keep offline, encrypted backups and test them on a regular schedule.
A tested recovery plan is what turns a bad day into a short one. Help with disaster recovery and business continuity can cover the backup side, while managed IT services can keep patching and account reviews on a steady routine.
If an attack does happen, StopRansomware.gov says victims should report it to federal law enforcement through IC3 or a Secret Service field office, and they can ask CISA for technical help.
What happens next
The advisory includes indicators of compromise that were seen between November 2024 and August 2026. IT teams can check logs against that list, but the agencies say to verify IP addresses before blocking them.
For ongoing guidance, StopRansomware.gov serves as the U.S. government's official one-stop site for ransomware resources.
