SafePay Ransomware: CISA Warns of 600+ Victims. Here Is What to Do

Also on CyberFence: compare CyberFence to other VPNs side-by-side · the free CyberFence security tools .

CISA, the FBI, the U.S. Secret Service and international partners have issued a joint warning about SafePay, a ransomware group that has now hit at least 600 victims. The advisory, #StopRansomware: SafePay Ransomware (AA26-293A), was published on October 20, 2026. It says the group has been active since August 2024 and was "among the most active ransomware groups in 2026."

The useful part is not the headline number. It is how SafePay gets in, and that is mostly stolen passwords, unpatched edge devices and phishing. Here is what the advisory says, what it means whether you run a business or just a few devices, and where a VPN and the rest of CyberFence fit.

What CISA Says Happened

• Who is affected: At least 600 separate victims from multiple critical infrastructure sectors across North America, South America, Europe and Australia. The advisory does not name individual sectors.
• How active: FBI official Cynthia Kaiser told Cybersecurity Dive that attacks appeared to peak at the end of 2025, but that the group has hit around 15 to 30 organizations each month throughout 2026.
• Known victims: Cybersecurity Dive notes the group has been linked to a 2025 attack on technology distributor Ingram Micro, which disrupted order processing for days and exposed personal data on more than 42,000 people.

How SafePay Gets In

According to the advisory, the group obtains initial access through credential exposure, brute force password attacks and exploiting VPN access. CISA describes the group as using phished account profiles to get into victim networks, and as exploiting five known vulnerabilities in internet-facing systems through automated scripts: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.

One detail matters for anyone who uses a VPN. When the advisory says "exploiting VPN access," it means attacks on a company's own remote-access gateway, using stolen logins or unpatched flaws. It also notes the group connects through the IP addresses of a commercial VPN provider to hide where it is coming from. A VPN service is a tool that anyone can use, which is exactly why a login that works from anywhere needs multi-factor authentication behind it.

What Happens After They Are In

1. Move around quietly. The group uses built-in Windows tools such as PsExec and Windows Remote Management, plus Remote Desktop and remote-management software. The advisory says AnyDesk and TeamViewer were installed in some cases.
2. Find the keys. The attackers look for credentials to gain administrator access and will create new accounts if needed. In some cases they changed system users' passwords, making valid logins impossible.
3. Turn off the alarms. They commonly disable security software before the next step.
4. Steal first. Data is compressed with tools like 7-Zip and WinRAR and sent out with WinSCP and RClone to accounts the attackers control. OneDrive was used in some instances.
5. Encrypt and extort. Files are locked with a hybrid ChaCha20 and RSA scheme and renamed with a .SafePay extension. The group typically demands a share of company revenue in cryptocurrency, phones victims to pressure them, and posts the stolen data on a leak site if they refuse.

For a deeper look at why encryption alone is not the whole story, see our guide on whether a VPN can stop ransomware.

Warning Signs to Watch For

Ransomware is easiest to stop before the encryption step. The advisory points to several signs that someone is already inside:

• Security software that is switched off or will not start, or tools you do not recognize such as AnyDesk or TeamViewer.
• New administrator accounts, or users who suddenly cannot sign in because a password was changed.
• Unexplained use of PsExec, Remote Desktop or remote-management tools between machines.
• Large, unusual file transfers to cloud storage or unfamiliar accounts.
• Files renamed with the .SafePay extension, or a ransom note on the desktop pointing to a Tor chat portal.

What Actually Reduces the Risk

CISA's key actions are clear: patch edge devices, require multi-factor authentication, and limit administrative tools. The advisory's full list is more specific:

• Patch firewalls, VPN appliances and other edge devices first, and prioritize known exploited vulnerabilities.
• Require MFA on every service you can, particularly webmail, VPNs and accounts that access critical systems.
• Use long, unique passwords. CISA recommends at least 15 characters, a password manager, no password reuse, and account lockouts after repeated failed logins.
• Keep offline, immutable backups that cover everything, and test restores.
• Segment your network so one compromised machine cannot reach everything.
• Limit admin rights and review accounts for new or unrecognized users.
• Monitor for odd activity with tools that log network traffic, including endpoint detection software.
• Block unknown remote access. Prevent untrusted origins from reaching internal remote services.

If You Think You Are Affected

CISA urges organizations to patch the known exploited vulnerabilities listed in the advisory and to conduct forensic triage to determine whether systems have already been compromised. If you see signs of an intrusion, the advisory's response steps are to isolate affected hosts by quarantining them or taking them offline, then begin threat hunting to scope the intrusion: collect logs and other artifacts to learn which devices and accounts were touched and when. Do not wait for the ransom note. Contact your IT provider or an incident response firm, and consider reporting the incident to CISA or the FBI.

Where CyberFence Fits

No VPN stops ransomware by itself, and it would be misleading to say so. A VPN protects the connection, not a server that still has an unpatched hole. What CyberFence can do is cut off a few of the easier routes into your accounts:

• Phishing sites: Web Shield is CyberFence's DNS-level filter that blocks known malware and phishing domains before they load. It works from lists of known bad sites, so a brand-new lure can still get through. See how DNS filtering works and whether a VPN protects from phishing.
• Logins on public Wi-Fi: The encrypted tunnel keeps people on the same network from reading your sign-ins, and the kill switch blocks traffic if the VPN drops. Read how the kill switch works and whether public Wi-Fi is safe.
• Leaked credentials: Breach Monitor is a separate CyberFence product that alerts you when your email appears in a known breach. It is not part of the $7.99 plan. Stolen credentials are a top entry route, so reset any password that shows up. See credential stuffing attacks and what Breach Monitor is.

What it does not do: patch your servers, replace MFA, remove malware already on a device, or restore files. Those are the jobs of updates, authentication and backups.

A 30-Minute Checklist

1. Turn on MFA for email, banking, cloud storage and any remote-access account.
2. Update your router, firewall, VPN gateway and every device that faces the internet.
3. Change reused passwords, starting with email and anything with admin rights.
4. Check that you have a backup that is disconnected from your main network, then try restoring one file.
5. Remove remote-access software you do not recognize, and review who has admin rights.
6. Turn on your VPN before you sign in on any network you do not control.

If you run a small business, our guide to ransomware and small business covers the next steps, and AI-driven ransomware shows where the trend is heading.

Why This Advisory Is Worth Your Time

It is easy to read a warning about critical infrastructure and assume it is about someone else. But the methods are ordinary: guessed passwords, reused logins, a router or firewall that missed a patch, and a convincing email. Those same weak points exist in a home office, a two-person firm and a hospital. The difference is how much you have to lose, and how long recovery takes without a good backup.

The Takeaway

SafePay is not magic. It succeeds through stolen passwords, missing patches and flat networks, which means the fixes are mostly in your hands. Patch, add MFA, back up offline, and use layered protection for the networks and sites you cannot control.

Want to go deeper? Read the CyberFence competitor comparison hub , our free privacy and security tools , or CyberFence plans and pricing .