CISA Warns SafePay Ransomware Has Hit 600+ Organizations and Destroyed Backup Systems

What happened

CISA has warned that SafePay ransomware (software that locks up files and demands payment) actors have compromised at least 600 organizations across multiple critical infrastructure sectors, combining data theft and encryption (scrambling data so only the holder of the key can read it) with deliberate attacks on backup systems to obstruct recovery.

Investigators observed connections originating from Mullvad VPN (a service that routes a connection through another network) addresses, alongside abuse of compromised account profiles and automated exploitation scripts. The advisory identifies five exploited vulnerabilities: CVE-2020-3259 (the public catalogue number for a specific software flaw), CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.

The October 20, 2026, joint advisory describes operations spanning North America, South America, Europe, and Australia since August 2024. cyber security Cyber Security News Ransomware 2 min.

Published with the FBI, United States Secret Service, and German and British law enforcement partners, it incorporates investigative findings collected through August 2026. These weaknesses span information exposure, authentication failures, unsafe deserialization, and improper access controls.

CVE-2024-40711 enables unauthenticated remote code execution (running programs on a machine from somewhere else) through deserialization of untrusted data and carries a critical CVSS score of 9.8. CVE-2024-40766 affects SonicWall SonicOS management access, potentially allowing unauthorized resource access and, under specific conditions, firewall (a barrier that decides which network traffic may pass) crashes.