SecOraLens
CriticalRansomwareCVE-2020-3259

SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers

Cyber Security News·Source published ·1 min read

What happened?

SafePay ransomware has affected at least 600 separate victims across multiple critical infrastructure sectors, according to a joint government advisory released on October 20, 2026. Active since August 2024, the group has targeted businesses and essential services across North America, South America, Europe, and Australia, becoming one of the most active ransomware threats in 2026. The attacks combine stolen passwords, exposed remote access services, and known software flaws.

Key details

  • SafePay ransomware has compromised at least 600 organizations across critical infrastructure sectors worldwide since August 2024.
  • Attackers gain initial access through stolen credentials, password guessing, phishing, and exploitation of known vulnerabilities in internet-facing systems.
  • The group exploits specific CVEs in edge devices and backup software, including CVE-2024-40711 in Veeam Backup & Replication for unauthenticated remote code execution.
  • Attackers target backup infrastructure by stopping Volume Shadow Copy Service and resetting network-attached storage to factory settings to prevent recovery.
  • Data is exfiltrated using common tools such as 7-Zip, WinRAR, RClone, WinSCP, FileZilla, and cloud services like OneDrive and Backblaze.

Affected

  • Organizations across critical infrastructure sectors in North America, South America, Europe, and Australia.
  • Veeam Backup & Replication systems vulnerable to CVE-2024-40711.
  • Edge devices affected by CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.

Fixes and mitigations

  1. Patch exposed systems, enforce multifactor authentication, and limit administrator privileges.
  2. Keep backup copies offline or protected against modification and deletion, and test restoration regularly.
  3. Segment networks to restrict lateral movement from compromised remote access accounts to sensitive servers and backup systems.
  4. Investigate unfamiliar accounts, unexpected remote tools, disabled protections, and unusual outbound transfers as a combined indicator of compromise.
  5. If intrusion is suspected, isolate affected machines, preserve logs, and investigate the full scope of the incident.

What to look for

  • IP addresses associated with SafePay intrusions, data hosting, client login panels, data exfiltration, and command and control (e.g., 104.26.2[.]223, 5.255.11[.]134, 88.119.167[.]239).
  • Hostnames observed in intrusions: WIN-SBOE3CPNAL, WIN-3IUUOFVTQAR, WIN-DK18BI83M0S, WIN-I1HRRJHCEIV.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories