CISA, the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and two UK National Crime Agency units published a joint advisory on 20 October describing SafePay, one of the most active ransomware operations of 2026. The group has extorted at least 600 victims since August 2024, and its playbook is the one most mid-sized organisations are still least prepared for.
What happened
The advisory documents SafePay's observed behaviour between November 2024 and August 2026. Initial access comes from exposed or brute-forced credentials, phished accounts, and unpatched internet-facing appliances. The actors routinely route through commercial VPN exit addresses, and they run automated scripts against edge devices to find known vulnerabilities rather than hand-picking targets.
Once inside, they use built-in administration tools to move laterally, then deliberately damage recovery: shadow copies are deleted and network-attached storage holding backups is reset. Data is stolen first, so victims face publication pressure on top of encryption, sometimes followed by direct phone calls.
The advisory lists two CVEs seen in SafePay intrusions: CVE-2020-3259, an information disclosure flaw in the web services interface of Cisco ASA and Firepower Threat Defense software, and CVE-2023-20269, an authentication separation flaw in the remote access VPN feature of the same platforms that lets an attacker brute-force credentials or open a clientless SSL VPN session.
Who is affected
Any organisation with remote access published to the internet and backups reachable from the same network. That describes most South African SMEs with a firewall, a VPN for staff or suppliers, and a NAS in the same rack.
- Companies running Cisco ASA or Firepower remote access VPN without the current firmware
- Firewalls, VPN concentrators and remote-management appliances that sit directly on the internet
- Backup targets - NAS boxes, backup servers, cloud gateways - reachable with the same credentials staff use daily
- Accounts without MFA, particularly service accounts, VPN accounts and anything with administrative rights
What to do now
Assume your internet-facing edge is the front door and prove your backups cannot be deleted by the same account that can encrypt your file server. The advisory's own claim is blunt: paying does not guarantee recovery.
- Inventory every internet-exposed device and confirm its firmware against the vendor's latest advisory, prioritising anything on CISA's known-exploited list
- Enforce MFA on VPN, remote desktop and all administrative accounts, and remove stale accounts and unused VPN profiles
- Keep at least one backup copy offline or immutable, and test a restore rather than trusting the backup report
- Restrict administrative tools and lateral movement paths, and alert on shadow copy deletion and mass file renaming
- Segment the network so a compromised workstation cannot reach the backup server or the hypervisor management interface
What this means for South African businesses
The pattern is not exotic malware; it is a forgotten VPN appliance that nobody has patched since it was installed, plus a backup share that the domain administrator can delete. In our experience the backup-destruction step is what converts a bad week into a closed business, and most SMEs discover their backups were reachable only after the fact.
Treat the SafePay advisory as a checklist for your own perimeter this week rather than as news about someone else's incident. If you cannot say which of your devices are internet-facing, that is the finding.
Source: CISA joint advisory AA26-293A, StopRansomware: SafePay Ransomware.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.