#StopRansomware: SafePay Ransomware

Descripción

Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication  October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics.  Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection. Follo

CVEs mencionados

• CVE-2020-3259
• CVE-2023-20269
• CVE-2023-27532
• CVE-2024-40711
• CVE-2024-40766

Fuente oficial

Alerta publicada por CISA / US-CERT. Consulta el advisory completo para detalles técnicos, indicadores de compromiso y mitigaciones específicas.