Shattered SafePay Ransomware Hits 600+ Organizations Worldwide
Article Content
- •SafePay ransomware has impacted over 600 organizations since August 2024.
- •Attack methods include credential theft and exploiting VPN vulnerabilities.
- •Key vulnerabilities exploited are CVE-2020-3259, CVE-2023-27532, and CVE-2024-40711.
The FBI, CISA, and U.S. Secret Service issued a joint advisory on October 20, 2026, warning that the SafePay ransomware group has compromised at least 600 organizations globally since August 2024, affecting critical infrastructure sectors. SafePay employs various attack vectors, including credential theft, brute-force attacks, and exploiting vulnerabilities in VPNs and edge devices. Specific vulnerabilities exploited include CVE-2020-3259, CVE-2023-27532, and CVE-2024-40711. The group operates a double-extortion model, stealing data before encrypting systems and threatening to publish the stolen information if ransoms are not paid. The advisory provides detailed tactics, techniques, and procedures (TTPs) for defenders to mitigate risks. Authorities emphasize the urgency of patching known vulnerabilities and implementing multifactor authentication to protect against these attacks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (11)
Following this threat?
Track Safepay, Ingram Micro and CVE-2020-3259 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What sectors are affected by SafePay?
What should organizations do to protect themselves?
Are there specific vulnerabilities I should be aware of?
Continue Reading
Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure… 
Chinese Smishing Gang Targets Ireland and Four Other EU Countries Ireland is identified as one of five EU countries targeted by the Chinese text-scam group known as Smishing Triad, as reported by the EU cyber security agency Enisa. This group conducts large-scale smishing operations, which involve sending fraudulent text messages that impersonate legitimate organizations to steal…