The FBI and European agencies say the SafePay ransomware gang has breached at least 600 organizations in the U.S. and Europe since August 2024 and is now among the most active ransomware groups of 2026. The advisory says SafePay gains access through guessed passwords, phishing, and exploited internet-facing flaws including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766, then creates or hijacks accounts, uses remote tools such as AnyDesk and TeamViewer, steals data, and encrypts systems.
Why it matters: This matters because it is a large, ongoing ransomware campaign affecting businesses and critical infrastructure, not an isolated incident. Organizations should urgently review exposure to the listed CVEs, harden remote access, reset weak passwords, watch for phishing and follow-up extortion calls, and check for misuse of legitimate admin tools.
2026.10.20
100% relevant
This article establishes a new tracked story by anchoring it to a joint law-enforcement advisory that quantifies SafePay's victim count, names its intrusion methods and CVEs, and frames the gang as a top-tier active ransomware threat in 2026.
← Back to all stories