The FBI, CISA and European law enforcement agencies issued a joint advisory on SafePay ransomware. The group has encrypted at least 600 organizations since August 2024 by exploiting five known flaws in firewalls, VPN gateways and backup servers.
Cybersecurity and law enforcement agencies in the United States, Germany and the United Kingdom issued a joint advisory on SafePay ransomware on 20 October 2026, filed under reference AA26-293A. The FBI, CISA, the US Secret Service, Germany's Rheinland-Pfalz State Criminal Police Office (LKA) and the UK's National Crime Agency (NCA) all signed it. According to the document, the group has encrypted at least 600 organizations since August 2024.
What happened
SafePay surfaced in the summer of 2024 and has grown quickly since. Its victims span North America, South America, Europe and Australia, and include both commercial businesses and critical infrastructure operators. The group runs a double extortion model: it steals data first, encrypts it second, and threatens to publish the stolen files if no payment arrives. Encrypted files carry the .SafePay extension.
The advisory lists four routes in: leaked credentials, brute-force password attempts, phishing, and known flaws in internet-facing devices. Five vulnerabilities are named as actively exploited: CVE-2020-3259 and CVE-2023-20269 (Cisco ASA/FTD firewalls), CVE-2023-27532 and CVE-2024-40711 (Veeam Backup & Replication), and CVE-2024-40766 (SonicWall SonicOS). Every one of them already has a vendor patch available.
Why it matters
What separates this campaign from a routine ransomware wave is that the attackers go after the backups first. As CISA describes the method, SafePay stops the Windows Volume Shadow Copy service, deletes shadow copies, and factory-resets any NAS devices holding backups that it finds on the network. By the time encryption starts, the copy you would have restored from is usually already gone.
The second detail worth noting is the profile of the exploited products. Those five flaws cover a firewall, a VPN gateway and a backup server — three of the most critical components in any network. They also tend to be the devices organizations patch last, because once installed and working, nobody touches them.
What this means for businesses in Türkiye
No Turkish victims appear in the advisory, but the targeted products are common in local SME networks. A typical office runs a single firewall facing the internet, remote staff connect over SSL VPN, and backups sit on a NAS inside the same network. Having all three exposed at once is precisely the setup SafePay looks for.
There is a legal dimension too. When encrypted data has also been exfiltrated, that constitutes a personal data breach under Turkish Law No. 6698. The data controller must notify the Turkish Data Protection Authority (KVKK) within 72 hours of becoming aware of the incident. Paying or refusing to pay the ransom does not remove that obligation.
What Kamer Bilişim recommends
- Check your edge device versions this week. Compare the firmware on your firewall, VPN gateway and Veeam server against the CVE list above. Schedule a maintenance window if a patch exists; if a device has reached end of support, start planning its replacement.
- Enforce multi-factor authentication on VPN and administrator accounts. Most initial access attempts that rely on a leaked or brute-forced password fail outright once a second factor is in the way.
- Keep one backup copy off the network and test the restore. Following the 3-2-1 rule, at least one copy should be offline or immutable, and the backup console should not be reachable from everyday user accounts. A backup you have never restored from is not a backup.
If you are not certain whether your firewall, VPN and backup configuration would pass these checks, our on-site team across the Anatolian side of Istanbul and our remote support engineers can run an assessment for you. Reach us through our contact page.
Source: Joint CISA / FBI advisory AA26-293A, eSecurity Planet, AttackIQ
Source: CISA