CISA says SafePay ransomware hit 600+ organizations and wiped backups
Original title: CISA Warns SafePay Ransomware Has Hit 600+ Organizations and Destroyed Backup Systems
The October 20 joint advisory covers activity since August 2024 and five exploited CVEs, including critical CVE-2024-40711.
CISA warned that SafePay ransomware operators compromised at least 600 organizations across critical infrastructure sectors in North America, South America, Europe, and Australia. The October 20, 2026 advisory, issued with the FBI, US Secret Service, and German and British partners, says the actors steal data, encrypt systems, and sabotage backups, including factory-resetting network storage. Initial access includes exposed credentials, phishing, brute force, and internet-facing vulnerable systems.
Unconfirmed: The advisory says listed addresses and legitimate tools need contextual checks before blocking.
- CVE-2024-40711 allows unauthenticated remote code execution and has CVSS 9.8.
- CVE-2024-40766 affects SonicWall SonicOS management access and can crash firewalls.
- Operators use PsExec, WinRM, RDP, AnyDesk, TeamViewer, WinSCP, and RClone.
- Encryption uses ChaCha20 and RSA; affected files get the .SafePay extension.
- Other exploited flaws named are CVE-2020-3259, CVE-2023-20269, and CVE-2023-27532.
Impact: Data theft, file encryption, and destruction of backups
| Product | Affected |
|---|---|
| SonicWall SonicOS | — |
- 1.Prioritize the five exploited vulnerabilities on exposed systems.
- 2.Enforce multifactor authentication, restrict admin privileges, and segment networks.
- 3.Maintain offline, encrypted, immutable backups and test restoration.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-3259 | Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services | 7.5 | 72% | KEVRansomware | KEV |
| CVE-2023-20269 | Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense | 9.1 | 25% | KEVRansomware | KEV |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication | 9.8 | 90% | KEVRansomwarePoC | KEV |
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) | 9.8 | 18% | KEVRansomware | KEV |
From the original article
3 min read at gbhackers.com
CISA has warned that SafePay ransomware actors have compromised at least 600 organizations across multiple critical infrastructure sectors, combining data theft and encryption with deliberate attacks on backup systems to obstruct recovery. The October 20, 2026, joint advisory describes operations spanning North America, South America, Europe, and Australia since August 2024. Published with the FBI, […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.