The FBI and cybersecurity agencies in Germany and the United Kingdom have issued a joint advisory on the SafePay ransomware group, saying it is “among the most active ransomware groups in 2026.” According to The Record, at least 600 organizations across the U.S. and Europe have been breached since August 2024, with the most recent incident cited in the advisory occurring in August. Targets include businesses and critical infrastructure.
The advisory says SafePay gets in by guessing passwords, exploiting vulnerabilities and phishing. It lists several vulnerabilities the group has used, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, and notes the group uses automated scripts to find vulnerable internet-exposed systems. Once inside, the agencies say, the attackers create new accounts or take over existing ones, use legitimate system tools to move around and find valuable files, disable security protections, and sometimes change users’ passwords to lock people out. They compress and steal data before deploying the ransomware, using remote desktop tools such as AnyDesk or TeamViewer to move it onto victim systems. Victims are asked for “a subset of company revenue in cryptocurrency,” and a representative phones the victim to add pressure.
The Record adds that the group’s leak site lists dozens of German companies and government organizations in Latin America and the U.S., that experts have said parts of SafePay’s code resemble LockBit, and that SafePay has claimed attacks on Microlise and on Conduent. The Conduent attack disrupted services across the U.S., including Medicaid, child support, food assistance and roadway tolls; Conduent announced an $80 million class-action settlement last Friday.
How to check if you’re affected
Affected products are internet-exposed systems that are still unpatched for the vulnerabilities in the advisory. The Record lists five CVE ids (above) and says the advisory names others, so read the full list in the CISA advisory (AA26-293A) and compare it with the products and versions you run.
- Patch or retire any exposed device or service that matches a listed CVE, and review whether it was exposed before it was patched.
- Audit for accounts you didn’t create, administrator accounts that changed hands, and unexpected user password changes.
- Look for AnyDesk or TeamViewer installed or running where nobody on your team put it.