[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-safepay-ransomware-has-hit-at-least-600-victims-agencies-say":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},11927,"safepay-ransomware-has-hit-at-least-600-victims-agencies-say","SafePay Ransomware Has Hit at Least 600 Victims, Agencies Say","Six US, German and UK agencies name five exploited flaws and describe how the group moves from stolen logins to encrypted files.","SafePay, a ransomware group active since August 2024, has hit at least 600 separate victims, according to a joint advisory from six law enforcement and cybersecurity agencies.\n\nThe FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the UK's North West Regional Organised Crime Unit published the advisory on October 20. It draws on investigations running as recently as August 2026. The agencies said victims span multiple critical infrastructure sectors in North America, South America, Europe and Australia, and that SafePay was among the most active ransomware groups of 2026.\n\nAccess comes through exposed or guessed credentials, brute force password attacks, phishing and VPN access. The advisory lists five CVEs (public identifiers for known software flaws). Two of them, CVE-2020-3259 and CVE-2023-20269, affect edge devices, meaning equipment at the network boundary. The agencies said attackers used phished account profiles, routed through IP addresses of the VPN provider Mullvad, to exploit those two. The other three, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, were exploited across internet-exposed systems using automated scripts.\n\nInside a network, the group creates or takes over accounts with administrative rights. It then moves around with built-in Windows tools such as PsExec and WinRM, plus remote desktop. ShareFinder.ps1 and SharpShares.exe locate file shares, tools including 7-Zip and WinRAR compress the data, and WinSCP and RClone pull it out. SafePay disables security software, sometimes changes user passwords to block valid logins, then encrypts files and demands payment in cryptocurrency.\n\nThe pattern is the useful part. Almost everything after the break-in is legitimate software doing ordinary admin work, so defenders have few malicious files to catch. The five CVE numbers carry identifiers from 2020 to 2024, which suggests the entry points are old flaws rather than fresh ones. The advisory's remedies fit that: patch regularly, especially firewalls and other edge devices, restrict administrative tools to the people who need them, and enforce multifactor authentication.\n\nThe 600 figure comes from the agencies' own investigations and is stated as a minimum. The real count of victims could well be higher.","[\"ransomware\",\"safepay\",\"cisa\",\"advisory\"]","2026-10-20T12:00:00.000Z","2026-10-20T19:01:54.114Z","2026-10-20T19:01:54.369Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Fix two accuracy problems: the author list leaves out CISA, which published the advisory (it is listed alongside the FBI, USSS and the others in the source), and the lead says the five CVEs affect 'firewalls and VPN gear' when the source only calls the first two edge-device flaws and the other three 'internet-exposed systems' (CVE-2024-40711 is not a firewall or VPN flaw), so state the scope as the source does or drop the product claim.","resolved","security",[32,33,34,35],"ransomware","safepay","cisa","advisory",[37],{"name":38,"url":39},"CISA Advisories","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa26-293a",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,106],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7044,"2026-10-20T19:05:30.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1020,"2026-10-20T19:47:35.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",548,"2026-10-20T20:35:59.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",537,"2026-10-20T20:17:07.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",271,"2026-10-20T15:25:03.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",256,"2026-10-20T20:26:14.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",207,"2026-10-20T12:50:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",136,"2026-10-20T16:32:21.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",134,"2026-10-20T14:57:15.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",119,"2026-10-20T13:00:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",88,"2026-10-20T09:36:16.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",82,"2026-10-20T18:45:39.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":18},"Reviews","reviews",38,{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]