SafePay

Search everything

Mentions · 7d4
Mentions · 30d4
All mentions4
First seenOct 20, 2026
Last mentioned3d ago

Timeline

4 articles · newest first

FBI and CISA warn SafePay hit at least 600 organizations

The independent group uses stolen or brute-forced credentials and VPN access, then steals data and appends .SafePay.

Security AffairsOct 22, 06:48 UTC · 3d agoRansomware 7 sources1 · 1 read

CISA says SafePay ransomware hit 600+ organizations and wiped backups

The October 20 joint advisory covers activity since August 2024 and five exploited CVEs, including critical CVE-2024-40711.

GBHackersupdated Oct 22, 06:48 UTC · 3d agofirst Oct 21, 07:07 UTC · 4d agoRansomwareExploited7 sourcesCVE-2020-3259 CVE-2023-20269 CVE-2023-27532+23 · 2 reads

FBI says SafePay breached more than 600 organizations since 2024

U.S., German, and U.K. agencies say the gang guesses passwords, phishes, and exploits listed flaws.

The Recordupdated Oct 22, 06:48 UTC · 3d agofirst Oct 20, 20:27 UTC · 5d agoRansomwareExploited7 sourcesCVE-2020-3259 CVE-2023-20269 CVE-2023-27532+23 · 1 read

CISA, FBI detail SafePay ransomware hitting 600+ victims since 2024

Agencies say SafePay uses stolen or guessed passwords, phishing, and five known edge-device flaws, then encrypts files for crypto payment.

CISA Advisoriesupdated Oct 22, 06:48 UTC · 3d agofirst Oct 20, 12:00 UTC · 5d agoRansomwareExploited7 sourcesCVE-2020-3259 CVE-2023-20269 CVE-2023-27532+2

Related CVEs

by mentions

CVE-2024-4071190%9.8
Unauthenticated Deserialization RCE in Veeam Backup & Replication
published Sep 7, 2024Veeam Backup & ReplicationKEVRansomwarePoC
CVE-2024-4076618%9.8
Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls)
published Aug 23, 2024SonicWall SonicOS (Gen 5 firewalls)KEVRansomware
CVE-2023-2026925%9.1
Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense
published Sep 6, 2023Cisco Adaptive Security Appliance (ASA)KEVRansomware
CVE-2020-325972%7.5
Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services
published May 6, 2020Cisco Adaptive Security Appliance (ASA) SoftwareKEVRansomware
CVE-2023-2753281%7.5
Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
published Mar 10, 2023Veeam Backup & ReplicationKEVRansomware

Appears with

FBIorganization · 4
SafePaythreat actor · 4
CISAorganization · 3
Landeskriminalamt Rheinland-Pfalzorganization · 2
United States Secret Serviceorganization · 2
National Crime Agencyorganization · 1
AnyDeskproduct · 1
Mimikatzmalware · 1
SonicWallvendor · 1
SonicOSproduct · 1
Conduentvictim · 1
Microlisevictim · 1
TeamViewerproduct · 1
U.S. Secret Serviceorganization · 1

Entities are extracted by the model from each article. First seen Oct 20, 2026, last mentioned 3d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.