CISA and partners warn of active SafePay ransomware campaign exploiting edge-device flaws
In short: A joint advisory from the FBI, CISA, USSS and European law-enforcement agencies details the SafePay ransomware group, active since August 2024 and responsible for at least 600 attacks across North America, South America, Europe and Australia. SafePay gains access via stolen/brute-forced credentials, phishing, and exploitation of known VPN and edge-device vulnerabilities, then uses legitimate admin tools to move laterally, disable defenses, exfiltrate data and encrypt files with a ChaCha20/RSA hybrid scheme before demanding ransom.
This summary was generated automatically by AI from CISA Advisories's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1Exploits CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 in edge devices and VPN products
- 2Uses Mullvad VPN IPs and phished accounts for initial access
- 3Employs legitimate tools (PsExec, WinRM, RClone, 7-Zip, WinRAR, AnyDesk, TeamViewer, Mimikatz) for lateral movement and exfiltration
- 4Encrypts files with a ChaCha20 stream cipher plus RSA key exchange, appending .SafePay extension
- 5Demands cryptocurrency ransom tied to company revenue, with double-extortion leak site and phone-call pressure
Why it matters
Any organization running VPN gateways, firewalls or other internet-exposed edge devices with the listed unpatched CVEs is at risk of credential theft, lateral movement and full-scale ransomware encryption, with data leak and extortion follow-through.
What it means for AI agents and contact centers
If your company runs VoIP/SIP infrastructure, Linux servers, VPN gateways or edge network devices, check whether any of them are affected by the listed CVEs (2020-3259, 2023-20269, 2023-27532, 2024-40711, 2024-40766), patch immediately, enforce MFA and least-privilege admin access, and monitor for use of legitimate remote-access tools like AnyDesk, TeamViewer or PsExec that could indicate lateral movement in your network.
Sources
- CISA AdvisoriesOfficialPrimary sourceOriginal article →„#StopRansomware: SafePay Ransomware“20 Oct 2026, 15:00Licence: US federal government work (17 U.S.C. §105) · our summary (content changed)
- Published by source
- 20 Oct 2026, 15:00
- Found by our system
- 20 Oct 2026, 21:46
- Summary generated
- 20 Oct 2026, 21:48
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy