Cyber One Solutions logo.
Get Support

Security Advisory

FBI, CISA, and Secret Service Detail SafePay Ransomware's Use of Years-Old Cisco, Veeam, and SonicWall Flaws

October 20, 2026 · Cyber One Solutions Security Team

On October 20, 2026, the FBI, CISA, and the U.S. Secret Service, joined by German and UK agencies, published a joint advisory on the SafePay ransomware group, active since August 2024 and linked to at least 600 victims, detailing how it breaks in through five known, years-old vulnerabilities in edge devices and internet-exposed systems rather than new or undisclosed flaws. Here is what the advisory says, which products those flaws affect, and what to check now.

On October 20, 2026, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Secret Service, joined by Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency, and the UK's North West Regional Organised Crime Unit, published a joint #StopRansomware advisory, AA26-293A, on the SafePay ransomware group. The advisory states that SafePay actors "have been highly active since August 2024" and have "impacted at least 600 separate victims from multiple critical infrastructure sectors," targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. The indicators of compromise it publishes span November 2024 through August 2026, which points to sustained, ongoing activity rather than a single past incident, according to the joint advisory itself.

How SafePay Gets In

The advisory describes initial access through "credential exposure, implementing brute force password attacks, and exploiting virtual private network (VPN) access." It states that SafePay actors route some of this activity through IP addresses belonging to the VPN provider Mullvad, and separately use "phished account profiles to access victim networks" to exploit two named vulnerabilities in what it calls "edge device products." A further three vulnerabilities, which it separately describes SafePay actors exploiting across "internet-exposed systems" "through automated scripts," are not tied to that phishing clause.

The advisory itself does not name the vendor or product behind any of the five CVEs, giving only the CVE number and its CWE weakness class. Checking each one against the National Vulnerability Database identifies them precisely. The two it groups under "edge device products" are:

The three it groups under "internet-exposed systems," reached through automated scripts, are:

None of these five is a new or undisclosed flaw. The oldest, the Cisco information-disclosure bug, was published in 2020; the Cisco VPN flaw and the first Veeam flaw date to 2023; the second Veeam flaw and the SonicWall flaw date to mid-2024. That is the substance of this advisory: rather than relying on a zero-day, federal investigators and their international partners say SafePay has spent roughly the last two years getting into networks through firewalls, VPN concentrators, and backup servers that were never patched for flaws with fixes that have existed, in the oldest case, for six years. If your organization, or whoever manages your network, runs a Cisco ASA or FTD appliance, a self-hosted Veeam Backup & Replication server, or a SonicWall firewall that has not been part of a regular patch cycle, that device is a plausible match for the exact entry path this advisory describes, independent of whether SafePay specifically has targeted you.

What Happens Once They're In

The advisory states that once inside, SafePay actors "create or take over accounts, move through networks with legitimate tools, disable security protections, encrypt files, and demand cryptocurrency payment." Separately, it documents that the group moves stolen data out using tools including WinSCP, RClone, and OneDrive before encrypting files, and that if a victim does not pay, the actors publish the stolen data to their own leak site. The ransom note itself is left on the victim's desktop or root directory and directs the victim to a chat portal on the Tor network, referenced by a victim-specific ID; the advisory also notes that SafePay actors follow up with phone calls to pressure victims directly. A phone call from someone claiming to be a ransomware negotiator following a breach is consistent with this group's documented pattern, not a reason on its own to dismiss or to comply with it, but useful context for whoever would field that kind of call at your organization.

What to Do Now

Why This Belongs on Your Radar

The pattern in this advisory is a useful corrective to the instinct that ransomware risk is mostly about the newest, most alarming vulnerability. SafePay's own documented activity says otherwise: a well-resourced, internationally tracked group with at least 600 victims has, among its several documented entry methods, been getting into networks for close to two years through ordinary network equipment that was simply never patched. A firewall, VPN concentrator, or backup server is easy to treat as "set it and forget it" once it is installed and working, which is precisely the gap this advisory describes exploiting. If any of the five vulnerabilities above apply to your environment, checking their patch status this week and applying the fix wherever a system is still exposed closes the specific CVE-based entry path this advisory names, but not the separate credential-exposure, brute-force, and phishing paths it also describes; treating a patch check alone as a complete response to this advisory, without also reviewing account credentials and the possibility of a prior compromise, would be the wrong lesson to take from it.

For businesses subject to the FTC Safeguards Rule or the HIPAA Security Rule, this advisory touches obligations beyond patching alone. The FTC Safeguards Rule requires nonbanking financial institutions to "establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information" under 16 CFR 314.4(h), addressing the plan's goals, internal response processes, defined roles and decision-making authority, internal and external communications, remediation of identified weaknesses, documentation of security events, and evaluation and revision of the plan after an event; the same rule separately requires testing or monitoring information systems under 16 CFR 314.4(d)(2), through continuous monitoring or other systems that detect vulnerability-creating changes on an ongoing basis, or, absent either, annual penetration testing plus vulnerability assessments at least every six months and also whenever a material change to operations or business arrangements, or other known circumstances, may materially affect the information security program. Under 16 CFR 314.6, institutions maintaining customer information on fewer than 5,000 consumers are exempt from 314.4(b)(1), (d)(2), (h), and (i), which cover the written risk assessment, continuous monitoring or periodic testing, the written incident response plan just described, and the Qualified Individual's annual written report to the board; the rest of the Safeguards Rule still applies to them. The HIPAA Security Rule's contingency-plan standard, 45 CFR 164.308(a)(7), separately requires covered entities and business associates alike, under 45 CFR 164.306(a), to maintain a data backup plan and a disaster recovery plan, both designated "Required," to create and maintain retrievable exact copies of electronic protected health information and to restore any data that is lost. The standard's related testing-and-revision requirement, 45 CFR 164.308(a)(7)(ii)(D), is "Addressable" rather than "Required": under 45 CFR 164.306(d)(3), an organization must still assess whether periodic restore testing is reasonable and appropriate for its circumstances, and if it decides not to implement it, must document why and implement an equivalent alternative if one is reasonable and appropriate; skipping the assessment and documentation entirely is not an option "Addressable" makes available. Absent that documented alternative, actually testing a restore, not just installing backup software, is the straightforward way to meet it.

If any of the systems named above are part of your network, confirm their patch status this week. Cyber One Solutions tracks CISA and FBI advisories and vendor patches for common business edge devices as part of our managed cybersecurity service, and our backup and disaster recovery service designs every plan with immutable or isolated copies by default rather than treating backup software as a one-time install. Our backup and disaster recovery readiness check is a free self-assessment that gives an instant readiness indicator from ten questions about your own backups and recovery testing, not a formal audit, and our IT and security assessments can confirm your current patch exposure as a standalone engagement.

Sources