7JUN

Six agencies tie SafePay to old flaws

3 min read

10:08UTC

A joint advisory from agencies in the US, Germany and the UK credits SafePay with at least 600 victims and names five entry flaws dated 2020 to 2024. All five were already on CISA's exploited list.

← Back to The 2024 patch that is breaking now Jump to analysis ↓

TechnologyAssessed

Key takeaway

SafePay's five named entry flaws had all sat on CISA's exploited list for two to three years.

A joint advisory published on 20 October credits the SafePay ransomware group, active since August 2024, with at least 600 victims across North America, South America, Europe and Australia⁠¹. Six agencies in three countries signed advisory AA26-293A: CISA, the Federal Bureau of Investigation (FBI) and the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz (the Rhineland-Palatinate state criminal police), Britain's National Crime Agency (NCA) and the North West Regional Organised Crime Unit. It names five flaws behind the group's access: two in Cisco's Adaptive Security Appliance (ASA) firewalls, two in Veeam Backup & Replication and one in SonicWall SonicOS, dated 2020 to 2024.

All five had been in CISA's catalogue of exploited flaws for two to three years, added between August 2023 and October 2024, each flagged as used in ransomware campaigns⁠². So the advisory set no new federal deadlines, unlike the 8 October China advisory, which put five old, unlisted flaws on a three-day clock. The two Veeam flaws sit in backup servers, and the advisory describes SafePay resetting network-attached storage (NAS) backups to factory settings. The product the group breaks in through is the one its victims would recover from.

The catalogue's own clock points the other way. Of 24 flaws CISA added from 1 to 21 October, 21 carried three-day deadlines, a higher share than in September; from 13 to 20 October it was 12 of 15⁠³. CISA marked ransomware use as unknown for all 15 of those additions. Federal urgency sits on the newest listings, while the advisory shows a ransomware crew still collecting victims through entries flagged for ransomware years ago.

Deep Analysis

In plain English

SafePay is a ransomware gang: it breaks into company networks, locks the files and demands money. Police and cyber agencies in the US, Germany and the UK published a joint warning about it on 20 October, crediting it with at least 600 victims. The warning lists five security holes the gang uses, in firewalls and in backup software. All five are years old and already have fixes. The gang also wipes backups, so victims cannot simply restore their files.

Deep Analysis

Root Causes

Edge firewalls and backup servers often sit outside routine patch cycles, because restarting them interrupts remote access or backup windows. Flaws in them persist long after a fix ships.

Backup servers also hold broad access to every system they protect. Breaking into Veeam Backup & Replication gives an attacker a map of the network and the power to delete recovery points, and the advisory describes SafePay resetting NAS backups to factory settings.

What could happen next?

Meaning
A named-actor advisory produced no same-day KEV deadlines because every flaw it named was already listed, so the 8 October pairing is not yet shown to be a method.
Immediate · Assessed
Risk
Organisations that never patched the listed Veeam and Cisco ASA flaws face both break-in and loss of their recovery path through the same product class.
Short term · Assessed
Opportunity
A European law-enforcement investigation behind the advisory raises the chance of arrests or infrastructure seizures against SafePay.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 8 October China advisory also named old flaws, dated 2015 to 2023, but those were unlisted, so CISA put them on a three-day clock the same day. All five SafePay flaws were listed by October 2024, so CISA had no new deadline to set on 20 October.

Counter-parallel: FIRESTARTER in April showed the opposite failure on Cisco ASA: a backdoor that survived every patch. SafePay's Cisco ASA flaws have had working fixes for years, so the failure sits in deployment, not in the fix.

The advisory says SafePay demands a subset of company revenue rather than a fixed sum, so each ransom scales with the victim's size. Wiping backups removes the victim's cheapest alternative to paying.

For defenders, the fixes cost nothing new: the patches already exist. The spend lies in finding forgotten Cisco ASA, Veeam and SonicWall devices and proving they are patched.

Consensus view: Advisory AA26-293A shows SafePay getting in through old, catalogued flaws and stolen or brute-forced credentials, not new zero-days. All five named flaws had sat in the KEV catalogue for two to three years, each already flagged for ransomware use.

Counter-view: The co-sealers say more about enforcement than defence. Germany's Landeskriminalamt Rheinland-Pfalz, Britain's National Crime Agency and the North West Regional Organised Crime Unit signed alongside the US agencies, which points to a European criminal investigation behind the advisory rather than US guidance alone.

Key tension: Whether CISA's three-day deadlines on new KEV entries do anything against a crew that lives off flaws listed years ago and left exposed on the internet.

First Reported In

Update #15 · Fridge hack spoils food in seven countries

CISA· 22 Oct 2026

Read original →

Causes and effects

Caused by

Ten agencies name Beijing firm in hacks

Unlike the 8 October China advisory, the SafePay advisory named only flaws already in KEV and set no new deadlines.

Occurred 8 Oct 2026

Read story →

CISA set three-day deadlines on 34 flaws

October's three-day share of KEV additions rose above September's 34 of 43.

Occurred 30 Sept 2026

Read story →

This Event

Six agencies tie SafePay to old flaws

The ransomware group's way in runs through flaws defenders were told to fix years ago, including in the backup servers its victims would recover from.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.