SafePay Ransomware: CISA/FBI Joint Advisory and the Path Into the Plant

CISA, the FBI, the U.S. Secret Service and partners in Germany and the UK released a joint #StopRansomware advisory today on the SafePay ransomware group (AA26-293A). SafePay was among the most active ransomware groups in 2026 and has hit at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe and Australia. The advisory names OT owners and operators as part of its audience.

SafePay gets in by stealing or guessing passwords, by phishing, and by exploiting known vulnerabilities in firewalls, VPNs and other internet-facing systems (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766). Here is how that path runs from the internet down toward the plant:

• The edge. VPNs, firewalls and remote access portals that have not been patched or that still allow a password-only login.
• Accounts. Once inside, the actors take over existing accounts or create new admin accounts.
• The business network. They move with tools that are already there, like PsExec, WinRM, RDP, AnyDesk and TeamViewer, and they turn off security software along the way.
• Backups. They stop shadow copies and reset network storage that holds backups back to factory settings, then steal data and encrypt.
• The control room. Historians, HMIs and engineering workstations that share accounts or flat network paths with the business side are the next stop.

What the Red Tiger team recommends this week:

1. Patch the five CVEs in the advisory on anything internet-facing, starting with firewalls and VPNs, and put MFA on every remote access path into the plant.
2. Check that IT and OT are actually segmented, with separate accounts and no shared domain admin reaching from the business network into the control room.
3. Keep offline backups of historian, HMI and controller project files, and test a restore before you need one.
4. Watch for new admin accounts, PsExec or WinRM activity, and remote desktop tools showing up where they don't belong.