SafePay Ransomware Hit 600 Victims: 6 Gaps Critical Infrastructure Left Open

SafePay ransomware did not need a zero-day to reach 600 victims across four continents. It needed gaps that organizations already knew about: unpatched edge devices, weak identity controls and backups reachable from production. This blog breaks down how SafePay operated, the six reasons critical infrastructure keeps losing to ransomware, and how to close those gaps before the next group arrives.

‍

What does it take to breach 600 organizations across four continents? Not a zero-day. Not a nation-state toolkit. Just stolen passwords, unpatched firewalls, and backups nobody thought to isolate. That was SafePay ransomware’s playbook, and it is exactly why critical infrastructure keeps losing to ransomware. The group did not need new techniques. It needed old gaps that were still open.

On October 20, 2026, the FBI, CISA, and the U.S. Secret Service published joint advisory #StopRansomware: SafePay Ransomware (AA26-293A) with partners in Germany and the United Kingdom. The advisory tied SafePay to at least 600 victims across critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024. It ranked SafePay among the most active ransomware operations of 2026.

SafePay ran no affiliate program. A single closed team handled every intrusion itself, from the first login to the leak site post, using an encryptor built on leaked LockBit code. It often moved from initial access to encryption within 24 hours.

None of its entry points were advanced. The group relied on:

• Stolen credentials
• Weak or bypassed multi-factor authentication (MFA)
• Five known vulnerabilities in firewalls, VPN gateways, and backup servers, the oldest patched as far back as 2020

The same gaps have carried ransomware into hospitals, manufacturers, utilities, and service providers for years. Most of them start with a known vulnerability that was never prioritized, and LOVI is built to close that gap. It shows security teams which vulnerabilities attackers are actively exploiting, on the exact products they run, before a ransomware group gets there first.

This blog breaks down how SafePay operated, the six reasons critical infrastructure keeps losing to ransomware, and how LOVI helps teams close those gaps before the next group arrives.

How SafePay Ransomware Works

• Initial access: Valid VPN and RDP credentials, an MFA policy bypassed by misconfiguration, and fake IT support calls over Microsoft Teams. The group also exploited five known vulnerabilities:
  ‍
  1. Cisco ASA and FTD: CVE-2020-3259 and CVE-2023-20269
  2. Veeam Backup & Replication: CVE-2023-27532 and CVE-2024-40711
  3. SonicWall SonicOS: CVE-2024-40766
     

• Persistence: New or elevated administrator accounts, ScreenConnect remote access, and the QDoor backdoor.
• Lateral movement: RDP, PsExec, and network share discovery. Mimikatz and DCSync gave the operators password hashes for every account in the domain.
• Data theft: Files archived with WinRAR and moved out through FileZilla, RClone, and cloud storage.
• Recovery sabotage: Shadow copies deleted, backup and security services stopped, and backup storage devices reset to factory settings.
• Extortion: Files encrypted with a .safepay extension and stolen data threatened on a leak site. Demands ran at 1% to 3% of annual revenue, and the operators phoned victims directly to apply pressure.

Every step relied on gaps that organizations could have closed in advance.

Why Critical Infrastructure Keeps Losing to Ransomware

SafePay was not an isolated problem. The FBI identified more than 2,100 ransomware incidents directed at U.S. critical infrastructure in 2025, and 14 of the 16 U.S. critical infrastructure sectors had at least one ransomware victim. Those figures came only from reported complaints, so the real total was higher.

Across sectors, the same six weaknesses kept appearing. SafePay used every one of them.

1. The Edge Is the Front Door, and the Hardest Door to Patch

Firewalls, VPN gateways, and remote access appliances face the internet by design. They have also become the most common way in.

• The shift: Breach data published in 2026 showed that exploiting known vulnerabilities overtook stolen credentials as the leading entry point for the first time in 19 years: 31% of breaches against 13%. ‍
• The growth: Within those exploitation cases, attacks on edge devices and VPNs jumped from 3% to 22% in a single year.

These devices resist patching for structural reasons. Updating a VPN gateway means downtime for every remote user behind it, and change-management approvals add more delay. For operators running round-the-clock services, finding that maintenance window is harder still.

SafePay’s Cisco and SonicWall targets fit this pattern exactly.

2. Old Vulnerabilities Never Die

Patches existed. They were not applied in time.

• Remediation: Only 26% of vulnerabilities in CISA’s Known Exploited Vulnerabilities (KEV) catalog were fully remediated across organizations in 2025, down from 38% the year before. The median time to fix rose from 32 to 43 days. ‍
• Exploitation: Edge vulnerabilities in the KEV catalog reached mass exploitation in a median of zero days after disclosure.

Waiting for confirmation made the gap worse. The KEV catalog marks whether a flaw has known ransomware use, but that marker often changes late. One firewall flaw waited 265 days between its KEV listing and confirmation of ransomware use, and no alert accompanied the change. Organizations that prioritized only flaws already flagged for ransomware stayed behind by design.

SafePay’s five vulnerabilities spanned 2020 to 2024. The oldest was six years old when the advisory named it.

The underlying problem was not a lack of patches. It was a lack of prioritization context. Security teams facing thousands of CVEs a year could not tell which ones were being exploited right now, against which products, and by whom. This is the gap LOVI is built to close: it correlates every CVE with CISA KEV status, EPSS scores, exploit maturity, and real-world exploitation observed by Loginsoft’s global sensor network. That lets teams act on an exploited edge flaw on day one instead of day 43.

Which of your vulnerabilities are attackers exploiting today?

‍

3. Identity Is Still the Weakest Control

Stolen credentials and vulnerability exploitation increasingly appeared together in the same campaigns. Identity failures took several forms, and none of them required technical sophistication:

• Infostealer exposure: Malware on employee or contractor machines harvested saved VPN and browser passwords, which were sold in bulk long before any ransomware group used them. Infostealer exposure was linked to roughly one in five SafePay victims with a known domain. ‍
• Weak passwords on privileged accounts: In one SafePay intrusion, the entry point was a domain administrator account with a weak password. ‍
• MFA that existed only on paper: In another, the victim had MFA configured for its VPN, but a policy misconfiguration let local and LDAP groups log in without it. The organization believed MFA protected its remote access. In practice, one password was enough. ‍
• Fake help desk calls: SafePay flooded employee inboxes with thousands of spam emails, then called the same employees over Microsoft Teams posing as IT support and talked them into granting remote access.

All four defeated controls that organizations believed they had in place.

4. Backups Sit on the Same Network as Production

Backups are the last line of recovery, and attackers know it. In many environments, backup servers, storage devices, and virtualization consoles were joined to the main domain and reachable from ordinary workstations. A single compromised account could reach the recovery systems directly.

SafePay went after recovery deliberately:

• Two of its five vulnerabilities targeted Veeam Backup & Replication, giving the attackers both stored credentials and control over backup copies.
• The operators deleted Windows shadow copies and stopped backup services before encrypting.
• In some cases, they reset network-attached storage devices holding backups to factory settings.

Backups that were reachable and writable from the compromised network did not count as backups once ransomware arrived.

5. Uptime Is the Leverage, and Legacy Limits Visibility

Critical infrastructure providers are judged by availability. A hospital, water utility, or logistics operator cannot stay offline while it rebuilds, and ransomware groups price that pressure into their demands. SafePay calculated ransoms as a share of revenue, set deadlines as short as 24 hours, and phoned victims directly.

Many operational systems run for 20 to 30 years and were never designed with modern threats in mind. A 2026 survey of more than 1,600 critical infrastructure security leaders found:

• 60% of their organizations had a significant breach in the past year.
• 68% lacked complete, real-time visibility into the assets on their operational technology (OT) networks.
• 42% named legacy, unpatchable OT assets as their single biggest risk.

Ransomware that never touches industrial controllers can still halt physical operations. The 2021 Colonial Pipeline incident showed this: an IT-side ransomware attack led the operator to shut down the pipeline as a precaution. Organizations that cannot see their full environment cannot tell how far an intrusion has reached, so they shut everything down.

6. Shared Providers Multiply the Damage

Third parties were involved in 48% of breaches in 2026 breach data. Many critical infrastructure operators rely on managed service providers, IT distributors, and remote support vendors, which turns those providers into part of their attack surface.

SafePay targeted MSPs and IT distributors directly. Its attack on Ingram Micro in July 2025 took down the distributor’s ordering and provisioning platforms worldwide. Access reportedly came through compromised VPN credentials. Industry analysts estimated losses of at least $136 million in sales for each day the company could not fulfill orders. One intrusion at a provider reached every downstream partner that depended on it.

The Pattern

‍

SafePay did not need to be advanced. It needed these gaps to stay open, and across 600 victims, they did.

Ransomware Mitigations for Critical Infrastructure

These measures apply to ransomware as a whole, not one group. Each closes a step that groups like SafePay depend on.

Shrink the Front Door

• Patch the exposed systems first: firewalls, VPN gateways, remote access appliances, and backup servers. ‍
• Act on KEV listings immediately: Treat any KEV-listed flaw on an edge device or backup platform as urgent from the day it is listed, without waiting for a ransomware label.
• ‍Know the exposure before it is listed: Maintain an accurate inventory of internet-facing products and versions, and get alerts the moment a vulnerability affecting them is disclosed or exploited. ‍
• Buy time where patching must wait: Restrict management interfaces to internal admin networks and disable unused VPN features. ‍
• Remove exposed RDP: Take direct internet exposure of RDP away entirely.

Fix Identity

• Require phishing-resistant MFA for VPN, email, remote management tools, and every privileged account.
• Audit VPN and remote access policies for groups or local accounts that bypass MFA.
• Monitor infostealer logs and breach data for corporate domains, and reset any exposed credential immediately.
• Require identity verification through a known channel before any remote support session.
• Restrict Microsoft Teams contact from external tenants, and allow only approved remote access tools.

Contain the Spread

• Segment networks so a single VPN account cannot reach every server and file share.
• Apply least privilege and time-based administrator access, and keep admin accounts separate from daily-use accounts.
• Restrict directory replication rights to domain controllers only.
• Use application control on servers to block unapproved remote access, archiving, and file-transfer tools.

Protect Recovery

• Keep backup servers off the main domain and unreachable from user networks.
• Maintain offline, encrypted, immutable backup copies.
• Protect backup, storage, and virtualization consoles with separate credentials and MFA.
• Test restores on a regular schedule, not only after an incident.

Detect the Staging Window

Ransomware rarely begins with encryption. Most intrusions spend hours or days on staging first:

• Disabling security tools
• Mapping file shares
• Archiving data
• Uploading data out

That staging phase is the real detection window.

• Lock down security tools: Turn on tamper protection for endpoint security so a signed-in attacker cannot switch it off. ‍
• Alert on combinations: Flag security tool changes, share enumeration, bulk archiving, and unusual outbound transfers when they come from the same account. ‍
• Treat recovery sabotage as encryption: Shadow copy deletion or boot recovery changes mean encryption is in progress. Isolate the host immediately.

Prepare to Respond

• Keep an incident response plan with offline copies and out-of-band contacts.
• Run tabletop exercises that cover ransomware with data theft, not encryption alone.
• Review third-party and vendor remote access regularly, and remove what is no longer needed.
• After an intrusion, reset credentials before restoring systems. Attackers who entered with valid passwords keep them through a rebuild.

First 30 Days: Where to Start

1. Patch or isolate every internet-facing system with a KEV-listed vulnerability.
2. Audit VPN and remote access for any path that bypasses MFA.
3. Move backup infrastructure off the main domain and confirm at least one immutable copy exists.
4. Turn on endpoint tamper protection across all servers.
5. Set a help desk rule: no remote session without identity verification through a known channel.

‍

How LOVI Helps Security Teams Stay Ahead of the Next SafePay

Every gap SafePay exploited started with the same question: which vulnerabilities in the environment are being used by attackers right now? Loginsoft Vulnerability Intelligence (LOVI) is built to answer that question before an attacker does.

• Alerts tied to the actual inventory: LOVI sends alerts based on the products and versions an organization actually runs, including firewalls, VPN gateways, and backup platforms. A new flaw in a Cisco ASA, SonicWall appliance, or Veeam server reaches the right team the moment it surfaces, not after it trends. ‍
• Prioritization grounded in real exploitation: Every CVE in LOVI is correlated with CISA KEV status, EPSS scores, exploit maturity, and ICS relevance. Teams see which vulnerabilities attackers are using today instead of sorting by severity scores alone. ‍
• AI-powered threat scores with evidence: LOVI’s threat scores come with the evidence and justification behind them. Security teams and leadership can both see why a vulnerability moved to the top of the list. ‍
• Live exploitation from Cytellite: LOVI surfaces CVEs observed in Cytellite, Loginsoft’s real-time threat intelligence platform, which is fed by a global sensor network. When automated scripts start scanning for a backup-server flaw, that activity shows up as exploitation evidence, not speculation. ‍
• Early warning before NVD: LOVI tracks emerging CVEs and pre-NVD insights gathered from vendor advisories, researcher publications, and social media. Teams can start assessing exposure before official enrichment catches up. ‍
• ATT&CK context: Vulnerabilities are mapped to MITRE ATT&CK techniques, which connects patching decisions to the attacker behaviors those flaws enable. ‍
• Integration through API: LOVI’s REST API pushes this intelligence into existing SIEM, SOAR, and ticketing workflows, so prioritized vulnerabilities turn into tracked remediation work.

SafePay’s five vulnerabilities were public, patched, and exploited for years before the advisory named the group. With exploitation-driven prioritization in place, those doors close long before a ransomware group reaches them.

Conclusion

SafePay ransomware reached 600 victims, but the playbook behind those numbers was never unique to one group. When LockBit and ALPHV collapsed in 2024, the ransomware ecosystem did not shrink. It fragmented, and new brands filled the gap within months. Leaked builders gave every new operation a mature encryptor from day one. Stolen credentials stayed cheap, and edge devices kept getting exploited faster than they got patched.

The next group will arrive with a different name, a different leak site, and a different ransom note. Its way in will look familiar:

• An unpatched firewall or VPN gateway
• A password without enforced MFA
• A backup server reachable from the production network
• A vulnerability that was known long before it was fixed

For critical infrastructure organizations, protection against SafePay was never the real test. The real test was how many of these gaps remained open when the next group came looking. Closing them starts with knowing which vulnerabilities attackers are exploiting right now. LOVI delivers that visibility, so teams can patch the systems ransomware targets first.

Try LOVI for free and see which vulnerabilities in the environment attackers are exploiting today.  

FAQs

Q1. What is SafePay ransomware?

SafePay is a double-extortion ransomware group active since August 2024. It runs as a closed operation without affiliates and uses an encryptor built on leaked LockBit 3.0 code. A joint FBI and CISA advisory (AA26-293A) linked the group to at least 600 victims across critical infrastructure sectors on four continents.

Q2. How does SafePay ransomware gain initial access?

SafePay mainly gains access with valid VPN and RDP credentials obtained through theft, brute force, phishing, or initial access brokers. It also exploits known vulnerabilities in edge devices and backup servers, abuses MFA misconfigurations, and uses fake IT support calls over Microsoft Teams to trick employees into granting remote access.

Q3. Which vulnerabilities does SafePay exploit?

The CISA advisory named five vulnerabilities:

• CVE-2020-3259 and CVE-2023-20269 in Cisco ASA and FTD
• CVE-2023-27532 and CVE-2024-40711 in Veeam Backup & Replication
• CVE-2024-40766 in SonicWall SonicOS

All five had patches available long before SafePay exploited them.

Q4. Why is critical infrastructure vulnerable to ransomware?

Critical infrastructure organizations run internet-facing edge devices that are hard to patch, depend on legacy systems, and cannot tolerate downtime. That gives attackers leverage. Weak identity controls, backups reachable from production networks, and dependence on third-party providers widen the gap, and ransomware groups exploit all of it.

Q5. How can organizations protect against ransomware like SafePay?

Patch internet-facing systems based on active exploitation, starting with KEV-listed flaws.

• Enforce phishing-resistant MFA everywhere and audit for bypass paths.
• Isolate backups and keep immutable copies.
• Segment networks and limit admin privileges.
• Detect staging activity such as security tool tampering and bulk data archiving before encryption begins.