CISA, FBI detail SafePay ransomware hitting 600+ victims since 2024
Original title: #StopRansomware: SafePay Ransomware
Agencies say SafePay uses stolen or guessed passwords, phishing, and five known edge-device flaws, then encrypts files for crypto payment.
FBI, CISA, the US Secret Service, and German and UK partners published a joint #StopRansomware advisory on SafePay, drawing on investigations as recent as August 2026. Since August 2024 the group has hit businesses and critical infrastructure in North America, South America, Europe, and Australia, with at least 600 victims, and was among the most active ransomware groups in 2026. Actors steal or guess passwords, phish VPN accounts (including via Mullvad IPs), and exploit listed edge and internet-exposed flaws, then use living-off-the-land tools, encrypt files, and demand cryptocurrency.
Unconfirmed: The advisory does not name individual victim organizations or confirm specific ransom payments.
- Initial-access flaws named: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
- Persistence uses existing or new accounts, then PsExec and WinRM for remote commands.
- IOCs are published as AA26-293A STIX XML and JSON.
- Authoring agencies urge patching edge devices, MFA, least privilege, and Zero Trust.
Impact: File encryption and ransom demand after network access
- 1.Patch firewalls and other edge devices, especially systems tied to the listed CVEs.
- 2.Require multifactor authentication and restrict administrative tools to necessary users.
- 3.Download AA26-293A STIX indicators and hunt for the described account and LOTL activity.
- ATT&CK
- T1110 Brute ForceT1190 Exploit Public-Facing ApplicationT1098 Account ManipulationT1136 Create AccountT1218 System Binary Proxy ExecutionT1021.002 SMB/Windows Admin SharesT1021.006 Windows Remote Management
- Threat actors
- SafePay
- Malware
- SafePay
- Organizations
- FBICISAUnited States Secret ServiceLandeskriminalamt Rheinland-PfalzNational Crime Agency
- Countries
- GermanyUnited Kingdom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-3259 | Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services | 7.5 | 72% | KEVRansomware | KEV |
| CVE-2023-20269 | Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense | 9.1 | 25% | KEVRansomware | KEV |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication | 9.8 | 90% | KEVRansomwarePoC | KEV |
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) | 9.8 | 18% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.26.2.223 | d August 2026. Table 2. IP Addresses IP Address Description 104.26.2[.]223 SafePay victim intrusion 140.82.114[.]4 SafePay victim in |
| ipv4 | 140.82.114.4 | Address Description 104.26.2[.]223 SafePay victim intrusion 140.82.114[.]4 SafePay victim intrusion 185.199.108[.]133 SafePay victim |
| ipv4 | 167.235.225.149 | fePay victim intrusion 173.194.194[.]94 Hosting victim data 167.235.225[.]149 Client login panels 5.255.11[.]134 Used in exfiltration 8 |
| ipv4 | 173.194.194.94 | Pay victim intrusion 77.37.49[.]40 SafePay victim intrusion 173.194.194[.]94 Hosting victim data 167.235.225[.]149 Client login panels |
| ipv4 | 185.199.108.133 | ay victim intrusion 140.82.114[.]4 SafePay victim intrusion 185.199.108[.]133 SafePay victim intrusion 77.37.49[.]40 SafePay victim int |
| ipv4 | 37.10.71.188 | n exfiltration 88.119.167[.]239 soc.dll command and control 37.10.71[.]188 Used in exfiltration Note: Some of these files are legiti |
| ipv4 | 5.255.11.134 | 4 Hosting victim data 167.235.225[.]149 Client login panels 5.255.11[.]134 Used in exfiltration 88.119.167[.]239 soc.dll command and |
| ipv4 | 77.37.49.40 | victim intrusion 185.199.108[.]133 SafePay victim intrusion 77.37.49[.]40 SafePay victim intrusion 173.194.194[.]94 Hosting victim |
| ipv4 | 88.119.167.239 | 149 Client login panels 5.255.11[.]134 Used in exfiltration 88.119.167[.]239 soc.dll command and control 37.10.71[.]188 Used in exfilt |
| sha1 | 07353237350c35d6dc2c8f143b649cd07c71f62b | networks. Table 4. SHA-1 Hash Values Hash File/Description 07353237350c35d6dc2c8f143b649cd07c71f62b 1.exe (ransomware binary) b498a2683640c983bb069fa2ea9e67cef |
| sha1 | b498a2683640c983bb069fa2ea9e67cef4a3797d | 7350c35d6dc2c8f143b649cd07c71f62b 1.exe (ransomware binary) b498a2683640c983bb069fa2ea9e67cef4a3797d Locker.dll PE32 executable BBFED53E3BB1F306F4DA97D995CF4AE5 |
| sha1 | bbfed53e3bb1f306f4da97d995cf4ae5b73ad081 | 3640c983bb069fa2ea9e67cef4a3797d Locker.dll PE32 executable BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081 locker.dll d711a5af5aed48a3b36b98f4fcf52809aebef7a2 nxc Tab |
| sha1 | d711a5af5aed48a3b36b98f4fcf52809aebef7a2 | cutable BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081 locker.dll d711a5af5aed48a3b36b98f4fcf52809aebef7a2 nxc Table 5. SHA-256 Hash Files Hash File/Description 921df |
| sha256 | 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 | c14bef8883054c1238ed5f080222cc464810e6e14adc346 Injected PE 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917 locker.dll PE32 executable a0dc80a37eb7e2716c02a94adc8df9ba |
| sha256 | 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a | d828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae soc.dll 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a RunPE bundled DLL e79608cf1d6b51324c14bef8883054c1238ed5f08 |
| sha256 | 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae | ef7a2 nxc Table 5. SHA-256 Hash Files Hash File/Description 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae soc.dll 6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0a |
| sha256 | a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 | b804ae3d262b57a56575053e2df67917 locker.dll PE32 executable a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526 locker.dll BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AE |
| sha256 | bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41 | 6c02a94adc8df9baedec192a77bde31669faed228d9ff526 locker.dll BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41 SharpShares.exe The following are IOC hostnames: WIN-SBOE3C |
| sha256 | e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346 | a33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a RunPE bundled DLL e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346 Injected PE 327b8b61eb446cc4f710771e44484f62b804ae3d262b57a |
From the original article
12 min read at cisa.govAdvisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.