FBI says SafePay breached 600-plus organizations since 2024
Original title: FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
US, German and UK agencies say the gang guesses passwords, phishes and exploits known flaws.
The FBI and cybersecurity agencies in Germany and the UK say SafePay has breached at least 600 organizations in the United States and Europe since August 2024. The advisory, drawn from FBI and German investigations with the latest incident in August, calls SafePay among the most active ransomware groups in 2026. It targets businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and phishing. Listed flaws include CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. After entry, actors create or take over accounts, use legitimate tools, and disable security protections.
Unconfirmed: Victim and activity figures are as stated by the law-enforcement advisory.
- Agencies say more than 600 victims are in the US and Europe since August 2024.
- The most recent investigated incident cited occurred in August.
- Named exploited flaws include CVE-2024-40711 and CVE-2024-40766, among others.
- Actors create or hijack accounts and disable security tools after access.
Impact: Ransomware breaches of businesses and critical infrastructure
- ATT&CK
- T1110 Brute ForceT1566 PhishingT1190 Exploit Public-Facing ApplicationT1136 Create AccountT1562 Impair Defenses
- Threat actors
- SafePay
- Malware
- SafePay
- Organizations
- FBI
- Countries
- United StatesGermanyUnited Kingdom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-3259 | Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services | 7.5 | 72% | KEVRansomware | KEV |
| CVE-2023-20269 | Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense | 9.1 | 27% | KEVRansomware | KEV |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication | 9.8 | 90% | KEVRansomwarePoC | KEV |
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) | 9.8 | 18% | KEVRansomware | KEV |
From the original article
2 min read at databreaches.netJonathan Greig reports: At least 600 organizations across the U. S. and Europe have been breached by the SafePay ransomware gang since August 2024, according to a new advisory from international law enforcement agencies.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.