Threat IntelligenceIncident ResponseSOC
CISA and the FBI say the SafePay ransomware group has compromised at least 600 organisations, and its operators reset or delete network-attached backups before they encrypt anything. According to the joint advisory AA26-293A, #StopRansomware: SafePay Ransomware, published on 20 October 2026 with the FBI, the U.S. Secret Service, and German and British law enforcement, the group has operated since August 2024. Victims span multiple critical infrastructure sectors across North America, South America, Europe and Australia.
Access comes from ordinary weaknesses. The advisory lists stolen or guessed credentials, brute-force password attacks, abuse of VPN access, phished account profiles and automated scanning of internet-facing systems. Operators reached victim networks through IP addresses from the Mullvad VPN provider. The five CVEs in the advisory include CVE-2024-40711, an unauthenticated remote code execution flaw rated 9.8, and CVE-2024-40766 in SonicWall SonicOS management access.
Backups go first. Operators stop the Volume Shadow Copy Service and reset network-attached storage holding victim backups to factory settings. In some cases they delete every network-attached backup before ransom talks start. This is the step that turns a bad day into a recovery problem, because victims who would normally restore from backup have to negotiate instead.
Data leaves before encryption. WinSCP, RClone and FileZilla move files out. OneDrive appears in some intrusions. Data is packed with 7-Zip or WinRAR and uploaded to Backblaze B2 using the b2.exe command-line tool. Connections are anonymised through Mullvad VPN addresses.
Encryption and extortion follow. Files are encrypted with ChaCha20 and RSA and renamed with a .SafePay extension. Ransom notes send victims to a Tor chat portal, where demands are set as a portion of company revenue and paid in cryptocurrency. Operators also phone victims and threaten to publish stolen data on a leak site.
Along the way, operators disable security software, change user passwords to lock out legitimate staff, and use PsExec, Windows Remote Management and Remote Desktop Protocol to move sideways. Their enumeration tools, ShareFinder.ps1 and SharpShares.exe, are built to find the shares with the most valuable data.
The advisory's most useful detection points are behavioural: a service stopping, an admin tool running from an unexpected host, an outbound transfer to a cloud storage bucket, and a backup target going quiet. Obiguard SOC is built for watching for that kind of activity across an estate and turning it into an investigation a team can act on, before encryption starts. It is the product to look at if the question on your desk is how you would know SafePay was already inside.
For the access side of the same story, see how the ConnectWise cloud backup supply-chain attack used compromised credentials.
If someone reset your backup storage tonight, how long would it take your team to hear about it?
Talk to us about detection coverage for your backup and identity systems.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →