FBI says SafePay breached more than 600 organizations since 2024
Original title: FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
U.S., German, and U.K. agencies say the gang guesses passwords, phishes, and exploits listed flaws.
An international law-enforcement advisory says SafePay has breached at least 600 organizations in the United States and Europe since August 2024. The FBI and agencies in Germany and the U.K. call it among the most active ransomware groups in 2026, targeting businesses and critical infrastructure. After access, the actors create or take over accounts, use legitimate tools, disable protections, steal files, and deploy ransomware, sometimes through AnyDesk or TeamViewer. Named victims include Microlise and Conduent, which announced an $80 million class-action settlement.
Unconfirmed: Experts previously said SafePay code resembles LockBit; the advisory does not confirm that link, and it names additional vulnerabilities only as others.
- The most recent investigated incident cited occurred in August.
- Listed flaws include CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
- Attackers may change user passwords and call victims to increase pressure.
- Demands are described as a subset of company revenue in cryptocurrency.
- The leak site lists German companies and government organizations in Latin America and the U.S.
Impact: Network access, file theft, and ransomware encryption
- 1.Check internet-exposed systems for the vulnerabilities named in the advisory.
- 2.Watch for unexpected AnyDesk or TeamViewer use and new or hijacked accounts.
- 3.Look for disabled security tools and archived files prepared for exfiltration.
- ATT&CK
- T1110 Brute ForceT1566 PhishingT1190 Exploit Public-Facing ApplicationT1219 Remote Access SoftwareT1486 Data Encrypted for Impact
- Products
- AnyDeskTeamViewer
- Threat actors
- SafePay
- Malware
- SafePay
- Organizations
- FBI
- Countries
- United StatesGermanyUnited Kingdom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-3259 | Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services | 7.5 | 72% | KEVRansomware | KEV |
| CVE-2023-20269 | Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense | 9.1 | 25% | KEVRansomware | KEV |
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2024-40711 | Unauthenticated Deserialization RCE in Veeam Backup & Replication | 9.8 | 90% | KEVRansomwarePoC | KEV |
| CVE-2024-40766 | Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls) | 9.8 | 18% | KEVRansomware | KEV |
From the original article
2 min read at therecord.mediaThe FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.