The FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit released joint advisory AA26-293A on 20 October detailing SafePay, which the authoring agencies call one of the most active ransomware groups of 2026 and link to at least 600 separate victims across critical infrastructure in North America, South America, Europe and Australia since August 2024. Initial access came from credential exposure, brute-force password attacks (T1110) and VPN accounts reached through Mullvad IP addresses, exploiting CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 across edge devices and backup infrastructure. SafePay actors escalate to administrative accounts, run PsExec, WinRM, ShareFinder.ps1 and SharpShares.exe, disable security software, exfiltrate via Rclone, WinSCP and OneDrive, halt the Volume Shadow Copy Service, factory-reset NAS backups, then encrypt with a ChaCha20/RSA hybrid that appends the .SafePay extension. Aimed explicitly at federal, state, local, tribal and critical-infrastructure operators, the advisory is now the authoritative TTP and indicator set for a group with confirmed Australian victims.

• Source article