The FBI, CISA, and international partners published a joint #StopRansomware advisory on SafePay ransomware on Oct. 20, 2026 (alert code AA26-293A). The advisory says SafePay actors have been "highly active since August 2024," that the group "was among the most active ransomware groups in 2026," and that it has "impacted at least 600 separate victims from multiple critical infrastructure sectors" across North America, South America, Europe, and Australia. The co-authors include the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the U.K.'s National Crime Agency, and the U.K.'s North West Regional Organised Crime Unit.
The useful part for a small business fits on one page: how SafePay gets in, what it does to backups, and which fixes the agencies put first.
How SafePay gets in, according to the advisory
CISA says SafePay actors "typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics." The advisory names five specific vulnerabilities. Product names below come from CISA's Known Exploited Vulnerabilities (KEV) catalog:
- CVE-2020-3259 and CVE-2023-20269: Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD). The advisory says actors used phished account profiles against VPN access to exploit these.
- CVE-2023-27532 and CVE-2024-40711: Veeam Backup & Replication.
- CVE-2024-40766: SonicWall SonicOS.
The advisory says the last three were exploited "across internet-exposed systems" for initial access "through automated scripts." None of these bugs is new. Each has been on CISA's KEV list since 2023 or 2024, and KEV marks all five as known to be used in ransomware campaigns. The risk is the firewall or backup server that never got the update.
What happens after they're inside
The advisory describes a familiar pattern. SafePay actors take admin rights on existing accounts or create new ones, then use built-in Windows tools such as PsExec, WinRM, and Remote Desktop to move around. They "commonly disable security software," and in some cases change users' passwords so valid logins stop working. The advisory lists remote-support tools such as AnyDesk, TeamViewer, and ScreenConnect among the tools they use, along with RClone, WinSCP, FileZilla, OneDrive, and Backblaze to move data out before encrypting files.
Two details matter most for a small office. First, CISA says SafePay actors "halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts." A backup on a NAS that the attacker can reach is not a safe backup. Second, the advisory says a representative "makes phone calls on behalf of the ransomware group" to pressure victims, and unpaid victims' data is posted to SafePay's leak site.
Why it matters to medical, industrial, and professional SMBs
Medical and dental practices, manufacturers and production shops, accounting and law firms, and other professional offices tend to share the same setup: a firewall or VPN appliance installed years ago, one backup server or NAS, and a few admin accounts nobody has reviewed lately. That is exactly the setup this advisory describes. All of them depend on restoring quickly, and the advisory shows SafePay going after backups on purpose.
Clear takeaway
Treat AA26-293A as a reason to check three things this week: whether your firewall, VPN, and backup software are patched against the five listed CVEs, whether every VPN and admin login requires MFA, and whether at least one backup copy is offline or immutable where an attacker with admin rights can't wipe it.
Patch and MFA checklist for this week
- Find your edge and backup gear. List every Cisco ASA/FTD, SonicWall, and Veeam Backup & Replication system you run, including ones a past vendor installed. Confirm each is on a version the vendor says fixes the listed CVEs. CISA says to "prioritize patching KEVs in internet-facing systems."
- Require MFA on VPN, webmail, and admin accounts. The advisory asks for MFA "for all services to the greatest extent possible—particularly for webmail, VPNs, and accounts that access critical systems."
- Hunt for accounts you don't recognize. CISA recommends reviewing domain controllers, servers, workstations, and Active Directory for "new, unactive and/or unrecognized accounts," and auditing admin accounts against least privilege.
- Get a backup off the network. CISA calls for offline backups that are "encrypted, immutable" and regularly tested. If your only copy sits on a NAS joined to the domain, fix that first, then test a restore.
- Review remote-access tools. Remove AnyDesk, TeamViewer, ScreenConnect, or other remote tools you don't use. Block remote services from unknown sources, and close unused ports.
- Tighten passwords and lockouts. The advisory points to long passwords (at least 15 characters), no reuse, and lockouts after repeated failed logins.
- Decide who you call. The agencies "do not encourage paying ransom" and ask victims to report to the FBI's IC3, an FBI or Secret Service field office, or CISA. Put those contacts, along with your insurer and IT provider, on a one-page incident card.
Brotherly Technology helps medical offices, manufacturers, and professional firms across Rome, Northwest Georgia, Atlanta, Chattanooga, and the Southeast turn advisories like this one into a short patch, MFA, and backup review. If you'd like a second set of eyes on your firewall, VPN, or backup server before the next headline, give us a call.
Sources:
- CISA / FBI et al.: #StopRansomware: SafePay Ransomware (AA26-293A). Released October 20, 2026; source of all quoted advisory text, the five CVEs, and the mitigations.
- CISA Known Exploited Vulnerabilities Catalog. Product names for the five CVEs and known ransomware-campaign use.