---
title: 'SafePay ransomware joint advisory reports at least 600 victims since August 2024'
url: 'https://securteksecurity.com/news/safepay-ransomware-joint-advisory-at-least-600-victims'
markdown: 'https://securteksecurity.com/news/safepay-ransomware-joint-advisory-at-least-600-victims.md'
date: '2026-10-20'
description: 'CISA, the FBI, the US Secret Service, German LKA Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit published joint advisory AA26-293A on October 20, 2026 on SafePay ransomware. The advisory says SafePay, active since August 2024, has impacted at least…'
taxonomy:
  category:
    - Cybersecurity
---

# [SafePay ransomware joint advisory reports at least 600 victims since August 2024](https://securteksecurity.com/news/safepay-ransomware-joint-advisory-at-least-600-victims)

   20th Oct 2026  

CISA, the FBI, the US Secret Service, German LKA Rheinland-Pfalz, the UK National Crime Agency and the UK North West Regional Organised Crime Unit published joint advisory AA26-293A on October 20, 2026 on SafePay ransomware. The advisory says SafePay, active since August 2024, has impacted at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe and Australia, and ranked among the most active ransomware groups of 2026. The indicator observation window runs from November 2024 to August 2026.

Initial access is through external remote services and VPN, exploitation of public facing applications, credential theft, phishing and brute force. The five listed CVEs map, per NVD, to Cisco ASA and FTD, CVE-2020-3259 and CVE-2023-20269, Veeam Backup and Replication, CVE-2023-27532 and CVE-2024-40711, and SonicWall SonicOS, CVE-2024-40766. Data is archived and exfiltrated, then encrypted with ChaCha20 and RSA, with a .SafePay extension, phone pressure and a leak site.

Sources: [Threadlinqs Intelligence](https://intel.threadlinqs.com/threat/TL-2026-3978); [tsecurity.de, CISA RSS mirror](https://tsecurity.de/de/4285494/malware-trojaner-viren/stopransomware-safepay-ransomware/)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [RMS Cloud breach fuels targeted phishing of Australian holiday park guests](https://securteksecurity.com/news/rms-cloud-breach-targeted-phishing-australian-holiday-park-guests.md)
- Next: [Santander and NVIDIA: specialised small models cut serving cost in selected experiments](https://securteksecurity.com/news/santander-nvidia-small-models-cut-serving-cost-selected-experiments.md)