SafePay Ransomware Affects 600+ Organizations
Original title: SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers
SafePay ransomware has compromised at least 600 organizations since August 2024 by exploiting exposed VPNs, remote access and backup servers.
The joint government advisory details SafePay ransomware targeting businesses and critical infrastructure across North America, South America, Europe and Australia. Attackers gain access through stolen credentials, phishing, vulnerable internet-facing systems and known flaws including CVE-2020-3259 and CVE-2023-20269. Once inside they use PsExec and RDP to spread, disable security software and encrypt files with ChaCha20. Backup infrastructure is specifically targeted with CVE-2024-40711 in Veeam allowing remote code execution. CISA urges patching and offline backups.
Unconfirmed: The advisory draws from investigations through August 2026.
- SafePay affected at least 600 organizations
- Exploits CVE-2020-3259, CVE-2023-20269 and CVE-2024-40711
- Uses exposed remote access services and VPNs
- Targets backup servers with Veeam flaw
- Operators use PsExec and RDP to spread malware
Impact: data theft, encryption and operational disruption
- 1.patch exposed systems
- 2.require multifactor authentication
- 3.limit administrator rights
- Threat actors
- SafePay
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-3259 | Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services | 7.5 | 72% | KEVRansomware | KEV |
| CVE-2023-20269 | Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense | 9.1 | 25% | KEVRansomware | KEV |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication | 9.8 | 90% | KEVRansomwarePoC | KEV |
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) | 9.8 | 18% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.26.2.223 | omise (IoCs):- IP Addresses IP address Reported association 104.26.2[.]223 SafePay victim intrusion 140.82.114[.]4 SafePay victim in |
| ipv4 | 140.82.114.4 | eported association 104.26.2[.]223 SafePay victim intrusion 140.82.114[.]4 SafePay victim intrusion 185.199.108[.]133 SafePay victim |
| ipv4 | 167.235.225.149 | fePay victim intrusion 173.194.194[.]94 Hosting victim data 167.235.225[.]149 Client login panels 5.255.11[.]134 Data exfiltration 88.1 |
| ipv4 | 173.194.194.94 | Pay victim intrusion 77.37.49[.]40 SafePay victim intrusion 173.194.194[.]94 Hosting victim data 167.235.225[.]149 Client login panels |
| ipv4 | 185.199.108.133 | ay victim intrusion 140.82.114[.]4 SafePay victim intrusion 185.199.108[.]133 SafePay victim intrusion 77.37.49[.]40 SafePay victim int |
| ipv4 | 37.10.71.188 | a exfiltration 88.119.167[.]239 soc.dll command and control 37.10.71[.]188 Data exfiltration Source: CISA advisory, Table 2. SHA-1 H |
| ipv4 | 5.255.11.134 | 4 Hosting victim data 167.235.225[.]149 Client login panels 5.255.11[.]134 Data exfiltration 88.119.167[.]239 soc.dll command and co |
| ipv4 | 77.37.49.40 | victim intrusion 185.199.108[.]133 SafePay victim intrusion 77.37.49[.]40 SafePay victim intrusion 173.194.194[.]94 Hosting victim |
| ipv4 | 88.119.167.239 | [.]149 Client login panels 5.255.11[.]134 Data exfiltration 88.119.167[.]239 soc.dll command and control 37.10.71[.]188 Data exfiltrat |
| sha1 | 07353237350c35d6dc2c8f143b649cd07c71f62b | Hashes File or description SHA-1 1.exe — ransomware binary 07353237350c35d6dc2c8f143b649cd07c71f62b Locker.dll — PE32 executable b498a2683640c983bb069fa2ea9e67 |
| sha1 | b498a2683640c983bb069fa2ea9e67cef4a3797d | 0c35d6dc2c8f143b649cd07c71f62b Locker.dll — PE32 executable b498a2683640c983bb069fa2ea9e67cef4a3797d locker.dll BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081 nxc d71 |
| sha1 | bbfed53e3bb1f306f4da97d995cf4ae5b73ad081 | cutable b498a2683640c983bb069fa2ea9e67cef4a3797d locker.dll BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081 nxc d711a5af5aed48a3b36b98f4fcf52809aebef7a2 Source: CISA a |
| sha1 | d711a5af5aed48a3b36b98f4fcf52809aebef7a2 | 97d locker.dll BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081 nxc d711a5af5aed48a3b36b98f4fcf52809aebef7a2 Source: CISA advisory, Table 4. SHA-256 Hashes File or desc |
| sha256 | 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 | 8ed5f080222cc464810e6e14adc346 locker.dll — PE32 executable 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 locker.dll a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde316 |
| sha256 | 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a | 4c9f5fe8b8379c6b7067d16b2ea10152300417eae RunPE bundled DLL 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a Injected PE e79608cf1d6b51324c14bef8883054c1238ed5f080222cc |
| sha256 | 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae | Table 4. SHA-256 Hashes File or description SHA-256 soc.dll 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae RunPE bundled DLL 6c1d36df94ebe367823e73ba33cfb4f40756a5e8e |
| sha256 | a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 | f710771e44484f62b804ae3d262b57a56575053e2df67917 locker.dll a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 SharpShares.exe BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129 |
| sha256 | bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41 | 94adc8df9baedec192a77bde31669faed228d9ff526 SharpShares.exe BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41 Source: CISA advisory, Table 5. Filenames and File Patterns |
| sha256 | e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346 | 23e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a Injected PE e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346 locker.dll — PE32 executable 327b8b61eb446cc4f710771e44484f |
From the original article
5 min read at cybersecuritynews.com
SafePay ransomware has affected at least 600 separate victims across multiple critical infrastructure sectors, according to a joint government advisory released on October 20, 2026. Active since August 2024, the group has targeted businesses and essential services across North America, South America, Europe, and Australia, becoming one of the most active ransomware threats in 2026. […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.