Ransomware

The FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit published joint advisory AA26-293A on October 20, 2026. It covers SafePay, a ransomware group active since August 2024 that the advisory says has hit "at least 600 separate victims" across critical infrastructure sectors in North America, South America, Europe and Australia. CISA's October 21 announcement rounds that to approximately 600.

If you run a Cisco ASA or Firepower Threat Defense (FTD) VPN, a SonicWall firewall or a Veeam Backup & Replication server that can be reached from the internet, this advisory is about you. The five vulnerabilities it lists are between two and six years old and all have fixes, so an unpatched edge device is the most likely way in.

How SafePay gets in

The advisory names three entry routes: exposed credentials, brute-force password guessing, and VPN access. Attackers connect from Mullvad VPN IP addresses and use phished accounts to reach Cisco edge devices vulnerable to two flaws. CVE-2020-3259 (CVSS 7.5) makes the ASA and FTD web services interface return device memory to an unauthenticated request, disclosing whatever confidential data that memory holds. CVE-2023-20269 sits in the remote access VPN feature: it lets an unauthenticated attacker brute-force usernames and passwords, and lets one with valid credentials open a clientless SSL VPN session they should not be allowed. Cisco scores it 5.0; NVD scores it 9.1.

The other three are run through automated scripts against anything exposed. CVE-2024-40766 (CVSS 9.3 from SonicWall) is improper access control in SonicOS management and SSLVPN on Gen 5, Gen 6 and early Gen 7 firewalls. The other two are in Veeam. CVE-2023-27532 (CVSS 7.5) lets anyone who can reach the Veeam.Backup.Service.exe process on TCP 9401 pull the credentials stored in the configuration database without logging in. CVE-2024-40711 (CVSS 9.8) is a deserialization flaw, where the server rebuilds objects from data an attacker controls, and it gives remote code execution on the backup server. All five have been in CISA's Known Exploited Vulnerabilities (KEV) catalog since 2023 or 2024.

What happens after the login

Once inside, the attackers give themselves administrative rights on existing accounts or create new ones. They escalate further with a User Account Control (UAC) bypass that starts an elevated process through a Component Object Model (COM) interface, and with token impersonation, borrowing a more privileged user's security token. Mimikatz and dcsync.exe pull credentials from memory and from Active Directory, and nltest.exe maps domain trusts.

Movement through the network uses tools admins already run: PsExec, Windows Remote Management (WinRM), Remote Desktop Protocol (RDP), and remote access products such as AnyDesk, TeamViewer and ScreenConnect, the last of which the group also uses for persistence. ShareFinder.ps1 and SharpShares.exe list file shares worth stealing. Before spreading, the actors disable security software, typically Windows Defender. Some victims found their own users' passwords changed.

Data is compressed and split with 7-Zip and WinRAR, then sent out with RClone, WinSCP, FileZilla, the Backblaze B2 command-line tool (b2.exe) or OneDrive.

Then they go after recovery. The actors halt the Volume Shadow Copy Service, so shadow copies cannot be used to roll files back, and they reset network attached storage (NAS) that holds backups to factory settings. In some cases they deleted all network-attached backups. Only then do they encrypt, using ChaCha20 for the file data and RSA to protect the keys, with full or partial encryption chosen by file type and size. Files get a .SafePay extension, the ransom note sends victims to a Tor chat portal with a victim ID as the login, and a representative phones the victim to push for payment. The demand is a share of company revenue, paid in cryptocurrency, and unpaid victims' data goes on the leak site. The binary may delete itself afterwards.

What to do

1. Patch the edge and the backup server first. Veeam Backup & Replication should be on 12.2.0.334 or later, which fixes CVE-2024-40711 and is well past the CVE-2023-27532 fixes (12.0.0.1420 P20230223 and 11.0.1.1261 P20230227). SonicWall Gen 5 needs 5.9.2.14-13o, Gen 6 needs 6.5.4.15-116n (6.5.2.8-2n on SM9800, NSsp 12400 and NSsp 12800), and Gen 7 needs a build later than 7.0.1-5035. For Cisco ASA and FTD, run your exact release through Cisco's advisories for both CVEs, since fixed releases differ by train.
2. If you cannot patch Veeam today, block inbound connections to TCP 9401 on the backup server's firewall. Veeam offers this only for all-in-one installs with no remote backup components, because the block also cuts off mount servers.
3. Put MFA on every VPN path. The advisory asks for multifactor authentication on VPNs, webmail and accounts that reach critical systems. On SonicWall Gen 5 and Gen 6, force local SSLVPN users to change their passwords and enable one-time-password MFA; restrict SSLVPN to trusted sources or switch it off if unused.
4. Set account lockout and long passwords. The advisory asks for passwords of 15 to 64 characters, lockout after repeated failures, and no forced changes more often than once a year.
5. Get one backup copy out of reach. The advisory asks for offline, encrypted, immutable backups in a separate, segmented location, with restores tested. A NAS that domain admin can reach over the network is exactly what this group factory-resets.

Checking whether you were already hit

Start at the edge. Look at VPN logs for logins from Mullvad exit addresses, bursts of failed authentications, and clientless SSL VPN sessions on Cisco devices that should not allow them. On Veeam servers, review which hosts have connected to TCP 9401 and whether stored credentials have been used from unexpected machines since.

On Windows hosts, hunt for the file names the advisory lists: dcsync.exe, sharefinder.ps1, SharpShares.exe, netscan.exe, nxc.exe (NetExec), b2.exe and AcronisDiskDirector. Look for new admin accounts, AnyDesk or ScreenConnect installs nobody asked for, and the four attacker machine hostnames the advisory lists. An event showing the Volume Shadow Copy Service stopped, or a NAS reset, puts you at the group's last step before encryption.

Treat the indicator list as leads. The advisory says to verify each IP address before blocking it, and many of the listed files are legitimate tools that only matter when nobody on your team installed them. The full indicators, observed between November 2024 and August 2026, are in the STIX files linked from CISA's advisory page.

If you find activity before encryption, isolate those hosts, scope the intrusion from logs and report it to the FBI (Report Fraud in the UK) before evicting. Afterwards, rotate every credential the backup server stored, the VPN and local firewall accounts, and any domain account whose password could have been pulled with Mimikatz or DCSync.

Why the backup server is on this list

Two of the five CVEs are in backup software. Owning the backup server removes the option to restore and often hands over stored domain credentials too. Treat it as a tier 0 system: its own admin accounts, no internet exposure, and patches on the same timeline as the firewall.

Our attack surface management work finds exposed VPN portals, firewall management interfaces and backup consoles before a scanning script does, and our security operations team hunts for the tools and behaviour in this advisory. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Joint advisory AA26-293A (PDF, IC3), CISA announcement, SafeBreach via Security Boulevard, CISA KEV catalog, NVD CVE-2023-20269, NVD CVE-2020-3259, Veeam KB4424, Veeam KB4649, CERT-EU advisory 2024-092, Rapid7 on CVE-2023-27532, Arctic Wolf on CVE-2024-40766, Qualys on CVE-2024-40766.