Friday, 23 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Original illustration: a dark server room where shadowy hooded figures dissolve into streams of encrypted data flowing through a glowing VPN tunnel, red warning lights on backup servers behind, teal-and-amber cinematic grade

SafePay Ransomware Hit 600+ Organizations — and Hid Behind the VPN You Trust

by

In brief

  • A joint advisory (AA26-293A), published October 20, 2026, by CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK agencies, names SafePay one of the most active ransomware operations of 2026.
  • SafePay has affected at least 600 organizations across multiple critical infrastructure sectors since August 2024, with victims in North America, South America, Europe, and Australia.
  • The group gets in through exposed or phished credentials, brute-force password attacks, and vulnerable edge devices — and investigators observed attack traffic originating from Mullvad VPN exit IPs, the same privacy service many readers use to stay anonymous.
  • Once inside, SafePay steals data, encrypts systems with ChaCha20+RSA (files get a .SafePay extension), threatens to publish the stolen data, and deliberately destroys backups — stopping shadow copies and even resetting network-attached backup storage to factory settings.
  • The agencies’ message: patch your edge devices, enforce multi-factor authentication, keep offline backups, and report incidents to law enforcement — because paying the ransom doesn’t guarantee you get your files back.

Update, October 22: reverse-engineering published by Huntress and reported by TechNadu finds extensive overlap between SafePay’s ransomware binary and the leaked LockBit Black source code — SafePay appears to be built on code the disrupted LockBit operation left behind. SafePay had already become the most prolific ransomware group in May 2025, surpassing Qilin, and the 2025 Ingram Micro breach has been publicly linked to it. The advisory’s victim count still stands at 600+.

How SafePay works, in plain terms

SafePay emerged in August 2024 as a private ransomware group — no affiliates, no franchise model like the older operations it replaced (BlackCat/ALPHV and LockBit, both disrupted by law enforcement). Running its own operation, it has steadily climbed into the top tier of active ransomware crews.

The attack follows a pattern the advisory lays out in detail:

Getting in. The initial access is unglamorous: stolen or guessed credentials, brute-force password attacks, phishing, and exploitation of internet-facing systems. The advisory names five specific vulnerabilities across firewall, VPN, and backup products: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. The nastiest of these, CVE-2024-40711, allows unauthenticated remote code execution and carries a critical CVSS score of 9.8. CVE-2024-40766 affects SonicWall SonicOS management access. Two of the flaws were patched in 2024 — and are still being exploited in 2026, because unpatched edge devices are everywhere.

Moving sideways. Once inside, the attackers create new accounts or escalate existing ones to administrative privileges, then use legitimate Windows administration tools — PsExec, Windows Remote Management, Remote Desktop Protocol — to move through the network. Because these are the same tools IT departments use daily, the malicious activity blends into routine operations. They map network shares with tools like ShareFinder.ps1 and SharpShares.exe, locate the valuable files, and quietly exfiltrate them using WinSCP, RClone, OneDrive, and Backblaze B2.

The double extortion. Before encrypting anything, SafePay steals the data. Then it encrypts systems and threatens to publish the stolen files on its dark-web leak site if the ransom isn’t paid. In some cases, the operators reportedly call victims directly to pressure them into paying.

Killing the lifeboats. This is the detail that should change your backup strategy. SafePay deliberately inhibits recovery: it stops the Volume Shadow Copy Service and, in observed cases, resets network-attached backup storage to factory settings. Your backups are a target, not a safety net, unless they’re offline or immutable.

The advisory includes indicators of compromise in STIX format and draws on investigative findings collected as recently as August 2026. It notes that paying ransoms does not guarantee file recovery and urges victims to report incidents to law enforcement.

The Mullvad twist — and what it means for your VPN

Here’s the sentence from the advisory that deserves a second read: investigators observed attack connections originating from Mullvad VPN addresses. SafePay operators route their attack traffic through Mullvad’s exit IPs, alongside abuse of compromised account profiles and automated exploitation scripts.

Let’s be precise about what this does and doesn’t mean. It does not mean Mullvad is compromised or cooperating — Mullvad is a no-logs provider; it can’t see what its users do, and that’s the point. It means the same privacy property that protects a journalist or an activist also protects a ransomware operator. A VPN hides the origin of traffic, not its nature. Mullvad’s exit IPs look like ordinary VPN users to every firewall on the internet, which is exactly why attackers like them: their traffic blends into millions of legitimate sessions.

For defenders, the practical takeaway is narrower than “block Mullvad.” The advisory itself warns that historical IP indicators require corroboration before blocking. The real lesson: IP reputation is a weak signal. If your security depends on recognizing “bad” IP addresses, a commodity VPN defeats it. The defenses that work against SafePay are identity-based (multi-factor authentication, least privilege) and patch-based (close the edge-device flaws), not IP-based.

For privacy-minded readers, the twist cuts both ways. The VPN you use to keep your browsing private from your ISP is architecturally identical to the tool a ransomware crew uses to hide from investigators. That doesn’t make your VPN guilty — it makes the “VPNs are for criminals” argument and the “VPNs make you untraceable” marketing claim equally wrong. A VPN is a tunnel. What travels through it is a separate question. (Our guides on testing your VPN for leaks and verifying your kill switch cover the defensive side.)

What to do this week: the defense ladder

The advisory’s recommendations, translated into a prioritized checklist:

  1. Patch edge devices first. Firewalls, VPN concentrators, backup appliances — anything internet-facing. The five CVEs in the advisory are your starting list; check whether your vendors’ products are affected. Two of them were patched in 2024 and are still being exploited. Unpatched edge devices are SafePay’s front door.
  2. Enforce multi-factor authentication everywhere, especially on VPN and remote-access logins. Brute-force password attacks are one of SafePay’s three main entry methods. MFA turns a guessed password into a dead end.
  3. Restrict administrative tools and privileges. PsExec, WinRM, and RDP are SafePay’s lateral-movement toolkit. If your users don’t need them, they shouldn’t have them. Least privilege isn’t bureaucracy — it’s the difference between one compromised account and a compromised network.
  4. Protect your backups like they’re the target — because they are. Keep offline, immutable copies that ransomware can’t reach from inside your network. Test restores regularly. A backup you’ve never restored is a hope, not a plan.
  5. Segment your network. Flat networks let attackers walk from one compromised workstation to the backup server. Segmentation turns a breach into a contained incident.
  6. Report, don’t just pay. The agencies are explicit: paying doesn’t guarantee recovery, and reporting helps law enforcement track the operation. In the US, that’s the FBI’s Internet Crime Complaint Center (IC3) or your local FBI field office; CISA also takes incident reports.

For home users and small businesses without a security team: items 1, 2, and 4 cover most of your risk. Update your router and NAS firmware, turn on MFA for every account that offers it (start with email — password resets flow through it), and keep one backup copy disconnected from everything. That 3-2-1 rule — three copies, two different media, one offsite or offline — exists precisely because of groups like SafePay.

Sources

  • CISA joint advisory AA26-293A (with FBI, USSS, Germany’s LKA Rheinland-Pfalz, UK NCA, UK NWROCU), October 20, 2026 — via agency reporting.
  • BleepingComputer, “CISA: SafePay ransomware hit over 600 critical infrastructure orgs,” October 20, 2026.
  • GBHackers, “CISA Warns SafePay Ransomware Has Hit 600+ Organizations and Destroyed Backup Systems,” October 20, 2026.
  • The Circuitry, “CISA and FBI warn SafePay ransomware has hit at least 600 victims,” October 20, 2026.
  • technology.org, “SafePay Ransomware Hit 600 Victims, Agencies Warn,” October 21, 2026.
  • cyber.hendryadrian.com, “Joint Advisory Details SafePay Ransomware Tactics After at Least 600 Victims,” October 20, 2026.
  • TechNadu, “SafePay Ransomware: Advisory Urges Organizations to Apply Security Measures,” October 21, 2026 (Huntress LockBit Black overlap, May 2025 prolificacy, Ingram Micro link).

Sources

Related reading: Is a Free VPN Safe for Banking? What the Research Actually Shows · How to Tell If Your VPN Is Working · VPN Statistics 2026: 50+ Usage Facts, Market Data & Trends

Related: Chrome’s new Enhanced Protection features add a Gemini-powered scam detector, a “suspicious site” warning tier, and clipboard checks that warn you before you run a ClickFix command.

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment