Skip to content
SafePay Ransomware Hits 600 Organizations, Urges Immediate Action

SafePay Ransomware Hits 600 Organizations, Urges Immediate Action

First seen 21 Oct 2026, 19:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 19:14 UTC
  • •SafePay ransomware has impacted over 600 organizations since August 2024.
  • •Attack methods include credential theft, phishing, and exploiting VPN vulnerabilities.
  • •CISA and FBI recommend urgent patching of known vulnerabilities to prevent further attacks.

The FBI, CISA, and U.S. Secret Service issued a joint advisory on October 20, 2026, revealing that the SafePay ransomware group has compromised at least 600 organizations across critical infrastructure sectors since August 2024. The group employs various attack vectors, including stolen credentials, phishing, and exploiting vulnerabilities in internet-facing devices, particularly targeting VPNs. Key vulnerabilities exploited include CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. Once inside networks, SafePay actors use legitimate tools to navigate and disable security measures, encrypting files and threatening to publish stolen data if ransoms are not paid. The advisory emphasizes the urgency for organizations to patch vulnerabilities and implement robust security measures to mitigate the risk of attacks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 11d ago How this analysis works

Timeline

2023-03-10
CVE-2023-27532 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2023-09-06
CVE-2023-20269 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-02-15
CVE-2020-3259 added to CISA KEV
This high-severity vulnerability is actively exploited, allowing attackers to retrieve sensitive information from affected devices.
Cisa
2024-08-23
CVE-2024-40766 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-09-07
CVE-2024-40711 published
A critical deserialization vulnerability allows unauthenticated remote code execution, with a CVSS score of 9.8.
Cisa
2024-10-17
CVE-2024-40711 added to CISA KEV
The critical vulnerability is confirmed to be actively exploited, prompting urgent action from organizations.
Cisa
Recent
Joint advisory issued
FBI and CISA released a joint advisory detailing SafePay's activities and urging organizations to implement security measures.
Yahoo

More articles in this cluster (66)

Following this threat?

Track Inc Ransom, Ingram Micro and CVE-2020-3259 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (52)

1 / 4

Common questions

What organizations are affected?
At least 600 organizations across critical infrastructure sectors globally are impacted by SafePay ransomware.
What should organizations do to protect themselves?
Organizations are urged to patch known vulnerabilities, implement multi-factor authentication, and monitor network traffic.
Is SafePay ransomware actively exploiting vulnerabilities?
Yes, SafePay is actively exploiting several known vulnerabilities in internet-facing devices.