SafePay Ransomware: FBI & CISA Warn of 600+ Victims and Backup Destruction — CVE-2024-40711 Exploited

On 20 October 2026, the FBI, CISA, US Secret Service, and their counterparts in Germany and the United Kingdom released joint advisory AA26-293A — a rare five-agency alert naming a ransomware crew that has already compromised more than 600 organisations across critical infrastructure, and that will erase your backups before demanding a ransom. The group calls itself SafePay. If your Veeam server is unpatched or your SonicWall firewall still runs a 2024-era firmware, you are inside their target set. This is not a drill.

Who Is SafePay? A Closed Crew That Does Its Own Dirty Work

Most ransomware headlines in 2026 involve Ransomware-as-a-Service (RaaS) platforms — organisations like LockBit or Qilin that lease encryptors to affiliates. SafePay operates differently. Researchers at Picus Security describe it as a centralised, closed operation: the group writes its own malware, recruits no affiliates, and personally conducts every intrusion from initial access to ransom negotiation. That model means less operational noise and tighter OPSEC — attackers who know exactly what is on the victim’s network before they pull the trigger.

SafePay emerged in August 2024 and has accelerated dramatically through 2026. Its victim list spans North America, South America, Europe, Australia, and South and Southeast Asia. Double extortion is standard practice: data is exfiltrated before encryption, and victims who refuse to pay face publication on the group’s dark-web leak site.

The CVEs That Open the Door: Technical Breakdown

Advisory AA26-293A names five CVEs that SafePay operators exploit for initial access and lateral movement. These are not hypothetical — they appear in confirmed intrusion chains.

CVE	Product	CVSS	Impact
CVE-2024-40711	Veeam Backup & Replication	9.8 Critical	Unauthenticated RCE via .NET deserialization
CVE-2023-27532	Veeam Backup & Replication	7.5 High	Unauthenticated credential extraction from config
CVE-2024-40766	SonicWall SonicOS (SSL-VPN)	9.3 Critical	Improper access control, unauthenticated access
CVE-2023-20269	Cisco ASA / FTD SSL-VPN	5.0 Medium	Brute-force of VPN credentials without lockout
CVE-2020-3259	Cisco ASA / FTD (WebVPN)	7.5 High	Information disclosure — captures active session tokens

The Veeam flaws deserve special attention. CVE-2024-40711 allows a remote, unauthenticated attacker to execute arbitrary code on the Veeam backup server through a .NET deserialization chain. That single foothold gives SafePay access to every credential the backup solution has ever seen — credentials for vCenter, domain controllers, NAS devices, and cloud storage targets. The advisory notes that attackers immediately pivot from the Veeam compromise to enumerate the broader virtualisation environment.

CVE-2023-27532, the older Veeam flaw, extracts plaintext credentials from the Veeam configuration database — no password required, no exploit chain needed. Organisations that patched CVE-2024-40711 but skipped CVE-2023-27532 are not safe.

The Attack Chain: From VPN to Encrypted Domain Controller in Under 24 Hours

The advisory’s kill chain is consistent across confirmed intrusions. Understanding it is the first step to breaking it.

1. Initial access: Operators connect through Mullvad VPN exit nodes (making source attribution harder) and either exploit the VPN CVEs above or authenticate with credentials obtained through phishing or brute-force against exposed remote access portals.
2. Discovery: Standard Windows enumeration via net, nltest, and ADFind. The goal is to locate backup infrastructure and domain controllers within the first hour.
3. Credential access: Mimikatz is deployed to harvest cached credentials and Kerberos tickets from memory. Where Veeam is present, CVE-2024-40711 or CVE-2023-27532 yields every stored credential in one step.
4. Lateral movement: PsExec, WinRM, RDP, and ScreenConnect (legitimate remote-access tooling) are used for host-to-host movement. The use of signed binaries complicates EDR detection.
5. Exfiltration: Rclone, FileZilla, WinRAR, and 7-Zip transfer compressed archives to actor-controlled infrastructure. Double extortion depends on this step completing before encryption.
6. Backup sabotage: The Volume Shadow Copy Service is stopped (vssadmin delete shadows /all /quiet). Network-attached storage devices are reset to factory defaults, erasing all network shares and backup repositories.
7. Encryption: SafePay’s custom encryptor uses AES/ChaCha20 per-file with keys wrapped in RSA or x25519, and employs intermittent encryption to maximise throughput speed. Files receive a .safepay extension. Virtualised domain controllers are commonly targeted last — once encrypted, authentication across the estate collapses.

Why Backup Destruction Changes Everything

Traditional ransomware recovery advice — “keep offline backups, you’ll be fine” — assumes the attacker cannot reach your backups. SafePay’s playbook invalidates that assumption. By targeting the Veeam server first (because it holds every credential needed to reach everything else) and resetting NAS devices to factory defaults, the group systematically eliminates the organisation’s ability to recover without paying. CISA classifies this under ATT&CK technique T1490 (Inhibit System Recovery).

Indian enterprises with a single Veeam instance, network-connected NAS, and no air-gapped or immutable backup copy are particularly exposed. Cloud-connected backup to Azure or AWS is not immune either — if the Veeam credentials reach cloud storage, ransomware can delete those buckets too, unless immutability (object lock) is explicitly enabled.

This mirrors a pattern we have documented before in CVE-2026-105134 targeting AhsayCBS backup servers and in The Gentlemen Ransomware campaign — adversaries in 2026 are specifically engineering their attack chains to defeat recovery, not just encrypt data.

What You Should Do Right Now: Sanjay Seth’s Defensive Recommendations

As a practitioner who has hardened NOC and SOC environments across India’s enterprise, manufacturing, and financial sectors for three decades, here is the prioritised action list I would give any client facing this threat today:

1. Patch the Veeam CVEs — Today, Not This Sprint

Upgrade Veeam Backup & Replication to 12.3.0.310 or later, which resolves both CVE-2024-40711 and CVE-2023-27532. If a maintenance window is more than 48 hours away, firewall off port 9401 (the Veeam API port) at the perimeter and segment the backup server onto a dedicated VLAN with zero-trust micro-segmentation. No server in your network should be able to reach the Veeam API without explicit authorisation.

2. Patch or Replace SonicWall Appliances Running Vulnerable Firmware

CVE-2024-40766 affects SonicWall SSL-VPN and SonicOS Access Control — upgrade to the vendor’s indicated fixed versions immediately. Where upgrades are not possible within 24 hours, restrict management access and disable SSLVPN if it is not operationally required. Review SonicWall’s PSIRT portal for the current fixed-version matrix.

3. Implement Immutable Backups

At minimum, one backup copy must be immutable and offline or air-gapped. AWS S3 Object Lock, Azure Blob immutability policies, or dedicated tape rotation all qualify. Veeam’s Hardened Repository on Linux with immutability enabled is a viable on-premises option. Immutability must be enforced at the storage layer — not just by Veeam policy that the backup account can override.

4. Enforce MFA on All Remote Access Portals

The advisory is explicit: stolen credentials plus no MFA equals SafePay access. Every VPN, RDP gateway, and management interface must require a second factor. For organisations using FortiGate with FortiAuthenticator, configure RADIUS two-factor for SSL-VPN immediately and audit which accounts have saved passwords without MFA exemptions.

5. Block and Hunt for Mullvad VPN Exit IPs

CISA’s advisory includes a STIX/JSON IOC file with known Mullvad exit node IPs used by SafePay operators. Import these into your SIEM, EDR, and firewall deny lists. Also hunt retroactively — check the last 90 days of firewall and VPN logs for authentications from these prefixes. A successful login that nobody in your team can account for is a confirmed intrusion to investigate.

6. Restrict and Monitor Lateral Movement Tooling

SafePay relies on living-off-the-land binaries — PsExec, WinRM, ScreenConnect — that your own IT team likely uses. The defensive lever is behavioural baselining: alert on PsExec invocations outside business hours, WinRM connections from non-IT accounts, and Rclone or 7-Zip processes on servers. Application allow-listing (App Control in FortiEDR or Windows Defender Application Control) goes further by blocking unsigned executables entirely.

India Exposure: Why This Advisory Matters Here

India’s manufacturing and financial sectors have undergone rapid digitalisation, but backup hygiene has not kept pace. The 2023 CERT-In ransomware survey found that fewer than 40% of mid-market Indian firms had tested their backup restoration within the previous 12 months. SafePay’s model — compromise the backup first, encrypt second — is precisely calibrated to exploit that gap. India’s data-localisation mandate under the Digital Personal Data Protection Act also increases the blast radius of a successful double-extortion attack: breached personal data must be reported within 72 hours, and a simultaneous encryption-plus-exfiltration incident will easily exhaust that window before an incident response team is even engaged.

The advisory’s cross-sector victim list (finance, healthcare, manufacturing) maps directly onto sectors where P J Networks regularly engages. If your sector is in that list, assume you are in scope.

Frequently Asked Questions

Is SafePay a RaaS operation? Who are the operators?

No. SafePay is a closed, non-affiliate group — it develops its own encryptor, runs every intrusion directly, and does not recruit external affiliates. This distinguishes it from LockBit, Qilin, or Inc Ransom. The identity and nation-state nexus of the operators have not been publicly attributed in the advisory, though the group’s operational discipline and tooling sophistication suggest a well-resourced team.

Does patching CVE-2024-40711 fully close the exposure?

Patching removes the initial access vector for that specific flaw, but it does not expel attackers who are already inside. After patching, organisations should rotate all credentials stored in or accessible through Veeam, review Active Directory for new privileged accounts or group memberships, and audit authentication logs for the prior 90 days. Additionally, CVE-2023-27532 should be patched in the same window — both flaws target Veeam and are listed in the same advisory.

What does the .safepay extension look like in practice, and can files be recovered without paying?

Encrypted files receive a .safepay appended extension (e.g., annual-report.xlsx.safepay). The encryption uses per-file AES or ChaCha20 keys wrapped with RSA or x25519 — no public decryptor exists. Recovery without paying the ransom requires clean, pre-attack backups that were not reachable from the compromised backup server. This is why immutable, air-gapped backups are the only viable recovery option.

How quickly does SafePay move from initial access to ransomware deployment?

Confirmed incident timelines from the advisory’s supporting cases show a sub-24-hour window from first access to encryption initiation in multiple intrusions. This is significantly faster than older ransomware groups (which typically dwelt for weeks). Automated initial recon, pre-staged tooling, and the Veeam pivot — which hands the attacker every credential at once — compress the dwell time dramatically. Alert thresholds tuned for multi-day incidents will miss SafePay.

Conclusion: Test Your Backups Before SafePay Does

The SafePay advisory is unusual in its breadth — five agencies, four countries, 600-plus confirmed victims in two years — and in its specificity: it names the exact CVEs, tools, and techniques used in real intrusions. For organisations in India’s critical infrastructure, manufacturing, or financial sectors, this is not background noise. It is a blueprint of how your environment may already be targeted.

The single most important action is to validate your backup recovery chain today — not next month, not next sprint. Specifically: verify that at least one backup copy is immutable and unreachable from your primary domain, rotate Veeam service account credentials, and confirm MFA is enforced on every remote access portal. Then patch the five CVEs in the table above in CVSS order.

If you need expert eyes on your backup architecture, remote access posture, or incident response readiness — or if you are not sure whether your SOC would catch a sub-24-hour intrusion — reach out to Sanjay Seth at P J Networks for a no-obligation security assessment. With three decades of hands-on network and security architecture experience across India, we will tell you exactly what your exposure looks like — and how to close it before the ransom note appears.