A joint advisory published on October 20 found the group often gets in with stolen or guessed passwords and known flaws in VPNs and firewalls.

 

What happened

The FBI, CISA, and the US Secret Service, together with law enforcement agencies in Germany and the United Kingdom, published a joint advisory on the SafePay ransomware group on October 20, 2026, advisory AA26-293A. The agencies said SafePay has been highly active since August 2024 and has affected at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia. They described it as among the most active ransomware groups of 2026. The advisory draws on FBI, Secret Service, and German police investigations as recent as August 2026. Its first recommendation for accounts is multifactor authentication on every service possible, naming webmail first.

 

Going deeper

SafePay usually gets in by stealing or guessing passwords, exploiting known vulnerabilities in firewalls and VPNs, or using phished accounts, according to the advisory. Once inside, the attackers give themselves administrator rights on existing accounts or create new ones, then use built-in Windows tools to move between systems, find valuable files, and switch off security software. They copy data out using legitimate file transfer and cloud storage tools, sometimes including OneDrive, and have installed remote access software such as AnyDesk and TeamViewer. Before encrypting files, they stop the Windows feature that keeps restore points and have reset network storage holding backups to factory settings, making recovery harder. The ransom note directs victims to a chat portal, and a representative phones victims to increase pressure.

 

What was said

"SafePay ransomware was among the most active ransomware groups in 2026," the agencies stated in the advisory. They said the group typically demands a portion of company revenue in cryptocurrency and posts stolen data on its leak site if a victim does not pay. The agencies do not encourage paying, saying payment does not guarantee files will be recovered and may encourage further attacks. They urged all victims to report incidents to the FBI or CISA whether or not they pay.

 

In the know

SafePay has already reached healthcare at scale. It is alleged to have carried out the October 2024 attack on Conduent, a company that supports about 100 million US residents across government health programs, which exposed the personal and health information of around 62 million people, Infosecurity Magazine reported. Conduent agreed this month to pay $80 million to settle the resulting class action, without admitting fault. The advisory lists five specific vulnerabilities the group has exploited, all of them in internet-facing products such as VPNs, firewalls, and backup software, and asks organizations to prioritize patching vulnerabilities already known to be exploited.

 

The big picture

The advisory's own resource list points healthcare organizations to HHS's Cybersecurity Performance Goals, and the overlap with SafePay's methods is close. Those goals set out a floor of safeguards for the sector, including email security, multifactor authentication, and basic cybersecurity training for staff, Healthcare Dive reported when HHS released them. SafePay's main ways in, like guessed or stolen passwords, phished accounts, and unpatched VPNs, are what those safeguards are meant to close off. The advisory adds practical steps that apply directly to hospitals: keep offline, encrypted, unchangeable backups and test restoring them, add a banner to emails from outside the organization, and give administrator access only when it is needed and only for a set time.

 

FAQs

How does SafePay usually get in?

Through stolen or guessed passwords, phished accounts, and known flaws in VPNs and firewalls, according to the advisory.

 

Why does SafePay go after backups?

Deleting restore points and resetting backup storage makes it harder to recover without paying.

 

Should victims pay the ransom?

The agencies don't encourage it, since payment doesn't guarantee recovery and may fund further attacks. They ask victims to report incidents either way.

 

What is an email banner for external messages?

A notice added to emails from outside the organization, reminding staff to take care with links and requests. The advisory recommends it.

 

What does just-in-time administrator access mean?

Admin rights are switched on only when someone needs them for a specific task and switched off afterward, so a stolen account is less likely to carry full control.