#StopRansomware: SafePay Ransomware (AA26-293A)

What it is

Joint advisory AA26-293A, published 20 October 2026 by the FBI, CISA, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit. It describes SafePay ransomware TTPs from investigations running to August 2026. The IOCs were observed between November 2024 and August 2026. The page text gives two named CVEs; the IOC and ATT&CK tables did not come through in the fetched text.

How it works

• Initial access: SafePay actors use Mullvad VPN IP addresses and phished account profiles to reach victim networks. They then exploit two edge-device CVEs: CVE-2020-3259 (CWE-200, information exposure) and CVE-2023-20269 (CWE-288, authentication bypass via alternate path). They also use brute force (T1110) and automated scripts against internet-exposed systems (T1190). The list of those further vulnerabilities is missing from the fetched text.
• Discovery and privilege: ShareFinder.ps1 and SharpShares.exe enumerate file shares. They use a COM-based UAC bypass (T1548.002) and token impersonation (T1134.001). They disable security software and sometimes change user passwords so valid logins fail.
• Lateral movement: PsExec, WinRM, RDP and RMM software. AnyDesk and TeamViewer are installed and used to push the ransomware.
• Exfiltration: FileZilla, 7-Zip, RClone and WinRAR stage data. WinSCP and RClone exfiltrate it, and sometimes OneDrive.
• Impact: They halt Volume Shadow Copy Service and factory-reset NAS devices holding backups. Encryption combines ChaCha20 with RSA, can be full or partial by file type and size, and appends .SafePay. Files cannot be recovered without the key. Ransom is typically a subset of company revenue in cryptocurrency. Operators phone victims, and data is posted to a leak site if unpaid. The binary may delete itself afterwards.

Preconditions / Affected

Exposed VPN or edge devices that are unpatched for CVE-2020-3259 or CVE-2023-20269 are the named entry points. Weak or exposed credentials without MFA also matter. Backups on NAS reachable from the compromised network are at risk of being wiped. Victims span North America, South America, Europe and Australia.

What to do

• Patch known exploited vulnerabilities on internet-facing systems first. The advisory points to CISA Binding Operational Directive 26-04 for prioritisation and forensic triage.
• Require MFA, especially on webmail, VPNs and accounts reaching critical systems.
• Use passwords of 15 to 64 characters, lock accounts after repeated failures, and avoid forced rotation more often than yearly.
• Keep offline, encrypted, immutable backups and test restores.
• Segment networks and use EDR to catch lateral connections.
• Filter traffic so untrusted origins cannot reach internal remote services.
• Audit domain controllers, servers and Active Directory for new or unrecognised accounts. Use just-in-time admin access.
• Restrict command-line and scripting permissions.
• Before encryption, isolate hosts, hunt to scope the intrusion, report, and build an eviction plan with CISA's Playbook-NG and COUN7ER. After encryption, use the Ransomware and Data Extortion Response Checklist in the #StopRansomware Guide.
• Test controls against the ATT&CK techniques in Tables 6 to 16 (matrix version 20).
• Four IOC hostnames: WIN-SBOE3CPNAL, WIN-3IUUOFVTQAR, WIN-DK18BI83M0S, WIN-I1HRRJHCEIV.

Caveats

The agencies tell defenders to verify IP addresses and tools before blocking, since some listed files are legitimate tools and cloud IPs may be reassigned. The tool list says these tools should not be treated as malicious without supporting evidence. The agencies do not encourage paying ransom.