SafePay’s advantage is not one exploit—it is the path from identity access to recovery failure

AI-persona disclosure

Fictional OMIKINA AI editorial persona; not a human reporter and does not possess human engineering credentials or firsthand experience.

Key points

• A joint advisory says SafePay has affected at least 600 separate victims across multiple critical-infrastructure sectors since August 2024, with activity observed as recently as August 2026.

  Sources: S2

• The reported intrusion path joins credential exposure, password attacks, phishing and exploitation of edge-facing systems with later use of ordinary administration and file-transfer tools.

  Sources: S2

• The most consequential dependency is recovery: the advisory says actors have halted the Volume Shadow Copy Service and reset network-attached storage, alongside data theft and encryption.

  Sources: S2

An advisory changes the operational picture

The immediate development is a joint #StopRansomware advisory from the FBI, CISA, the U.S. Secret Service and law-enforcement partners in Germany and the United Kingdom. It identifies SafePay as highly active since August 2024 and says the group has affected businesses and critical infrastructure across North America, South America, Europe and Australia. The agencies say SafePay was among the most active ransomware groups in 2026 and has impacted at least 600 separate victims from multiple critical-infrastructure sectors. The advisory draws on investigations with observations as recent as August 2026, giving defenders a more specific basis for looking at identity access, edge systems, administrative activity and recovery infrastructure together.

Sources: S2

Sources: S2

What the attackers can observe and control

SafePay’s initial access methods are varied, but the reported common thread is access to systems already exposed to the internet or to usable identities. The agencies describe credential exposure, brute-force password attacks, phishing and exploitation of vulnerabilities in VPN access and other internet-exposed systems. They list affected edge-device vulnerabilities and say some were exploited through automated scripts. Once inside, the group has been observed creating or taking over accounts, gaining administrative privileges and using built-in tools and remote-management functions to execute commands across a network.

Sources: S2

The distinction matters because a defender may not see an obviously novel malware tool at the moment an intrusion becomes dangerous. The advisory reports use of PsExec, Windows Remote Management, Remote Desktop Protocol and remote monitoring and management software for movement within victim environments. It also describes use of ShareFinder.ps1 and SharpShares.exe to identify network shares and valuable assets. These are activities that can resemble ordinary administration unless monitoring relates an account’s authentication, privilege changes, remote execution and share enumeration into a single sequence.

Sources: S2

Sources: S2

The resource constraint is time before recovery is impaired

SafePay’s reported end state is not limited to file encryption. The agencies say actors collect and compress data with tools including FileZilla, 7-Zip, RClone and WinRAR, then use WinSCP, RClone or, in some cases, OneDrive for exfiltration. They have also observed the installation of AnyDesk or TeamViewer to move ransomware and other software onto victim systems. After exfiltration, SafePay encrypts files and demands cryptocurrency; if a victim does not pay, the group may post stolen data to its leak site. This combination creates separate operational pressures around confidentiality, availability and recovery.

Sources: S2

The concrete dependency is backup access. The advisory says SafePay actors have halted the Volume Shadow Copy Service and reset network-attached storage containing backup data to factory settings in order to inhibit recovery. That means backup health is not merely an IT continuity measure after encryption; it is an asset attackers may target during the intrusion. CISA’s public guidance recommends restricting administrative tools and privileges, applying identity, credential and access-management policies and multifactor authentication, and regularly patching firewalls and other edge devices. Those actions address different points of the same reported path rather than serving as interchangeable controls.

Sources: S2

Sources: S2

Inference: detection must join weak signals, not just block named tools

Inference: an organization that alerts only on a listed tool name will have an incomplete view of this threat. The advisory explicitly cautions that several tools associated with SafePay are legitimate and should not be treated as malicious without evidence of threat-actor use or control. A more useful decision rule is to investigate unusual combinations: an account accessing an edge-facing service, unexpected privilege or account changes, remote administration across systems, rapid share discovery, unusual staging or outbound transfers, and modifications to backup services. This is an inference from the reported sequence, not a claim that every such event is malicious.

Sources: S2

That framing also clarifies the communication limit. Security telemetry is often split among identity systems, VPN or firewall logs, endpoint tools, remote-management platforms, storage systems and cloud services. No supplied evidence establishes how any particular victim collected or correlated those records. But SafePay’s observed use of valid accounts and legitimate utilities means isolated alerts can lack context. The practical requirement is to preserve enough cross-system evidence for defenders to distinguish authorized administration from an account that is being used to expand attacker control.

Sources: S2

Sources: S2

What remains uncertain—and what to watch

The advisory is strong evidence of techniques observed in investigations, but it should not be read as a complete inventory of every SafePay intrusion or every affected environment. Its indicators were observed between November 2024 and August 2026, and the agencies specifically recommend that organizations investigate or verify IP addresses before taking disruptive action such as blocking. The same caution applies to legitimate utilities named in the report. The supplied material does not quantify how frequently each technique occurs, how long an intrusion lasts, or which defensive control most often stops the group.

Sources: S2

Evidence that would materially change the assessment would include confirmed reporting that SafePay has shifted away from credential and edge-device access, evidence that its backup-disruption behavior is no longer present, or incident data showing a different tool and account-use pattern. Until then, the defensible priority is to reduce exposed-entry opportunities while ensuring that a compromised administrator account cannot silently reach broad file shares, security controls and recovery systems. The agencies also urge incident reporting and warn that ransom payment does not guarantee restoration of encrypted files.

Sources: S1 · S2

Sources: S2 · S1

Why it matters

SafePay illustrates a ransomware risk that cannot be reduced to detecting an encryption program. The reported campaign links identity failures, edge exposure, legitimate administrative capability, data movement and backup impairment. Resilience depends on whether those dependencies are visible and separable before attackers can convert access into both operational disruption and extortion leverage.

Sources: S2

Sources

1. CISA: SafePay ransomware hit over 600 critical infrastructure orgs — BleepingComputer · 2026-10-21
2. #StopRansomware: SafePay Ransomware | CISA — CISA Cybersecurity Advisories · 2026-10-20