SafePay Ransomware Exploits Veeam and SonicWall Flaws to Destroy Backups

A joint advisory released on 20 October 2026 warns that SafePay ransomware operators have compromised more than 600 organisations. The campaign targets critical infrastructure across North America, South America, Europe and Australia.

What happened

According to CISA, the group combines data theft with encryption while deliberately attacking backup systems. Operations have been active since August 2024. Investigators found connections originating from Mullvad VPN addresses. The advisory lists five exploited vulnerabilities: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.

CVE-2024-40711 allows unauthenticated remote code execution via deserialization in Veeam Backup & Replication, carrying a CVSS score of 9.8. CVE-2024-40766 affects SonicWall SonicOS management access. Attackers gain entry through exposed credentials, phishing, brute-force attacks and vulnerable internet-facing systems.

Why it matters

Once inside, operators establish persistence by creating accounts or abusing existing administrative privileges. They use legitimate utilities such as PsExec, Windows Remote Management and Remote Desktop Protocol for lateral movement. Tools like ShareFinder.ps1 and SharpShares.exe help enumerate network shares before exfiltration.

SafePay operators disable security software and change user passwords to prevent legitimate access. They use software packing and virtual machine protection to conceal malicious code. Remote access applications including AnyDesk and TeamViewer assist in delivering ransomware. Data theft involves WinSCP, RClone and OneDrive.

Next steps

• Audit internet-facing systems for the five listed CVEs.
• Review administrative account activity for unauthorised changes.
• Verify the integrity of backup systems and offsite copies.
• Monitor for connections from known threat actor infrastructure.

Detection notes

Teams usually monitor for unusual authentication patterns, especially from remote locations or unfamiliar IP ranges. Check whether standard administration tools are executing commands outside normal maintenance windows. Look for unexpected network shares being accessed or enumerated by internal processes. Verify that backup jobs are completing successfully and that no new accounts have been created with elevated privileges. Containment moves typically involve isolating affected endpoints and disabling compromised credentials immediately.

What to do and how to stay safe: SafePay

• Ensure all internet-facing systems are patched against the identified CVEs.
• Enforce multi-factor authentication to protect against credential theft.
• Monitor for abnormal use of remote management and administration tools.
• Maintain offline copies of critical data to ensure recovery capability.

Step-by-step guide: Infostealers Explained: How Data Theft Happens and How to Stop It

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific vulnerabilities are SafePay operators exploiting?

The advisory identifies CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.

How many organisations have been affected by SafePay ransomware?

At least 600 organisations across multiple critical infrastructure sectors have been compromised.

What methods do attackers use to move laterally within networks?

Operators use PsExec, Windows Remote Management, Remote Desktop Protocol and remote access applications like AnyDesk.