As reported by CISA in their October 20, 2026 advisory (AA26-293A), the SafePay ransomware group has been actively compromising organizations across four continents since August 2024. What stands out in this advisory isn't novelty— it's the stubborn persistence of old vulnerabilities as the primary entry vector. Shield53 assesses that SafePay's success reflects systemic patch hygiene failures more than sophisticated tradecraft.
Vulnerability Profile: Known Flaws, Repeated Exploitation
CISA identifies five CVEs commonly exploited by SafePay actors during initial access and lateral movement:
| CVE | Product | Weakness | CVSS / Severity | Patch Status |
|---|---|---|---|---|
| CVE-2020-3259 | Cisco ASA / FTD | Information Disclosure (CWE-200) | High (7.5) | Patched (legacy) |
| CVE-2023-20269 | Cisco ASA / FTD | Auth Bypass via Alt Path (CWE-288) | High (7.5) | Patched |
| CVE-2023-27532 | Veeam Backup & Replication | Missing Auth for Critical Function (CWE-306) | High (8.1) | Patched |
| CVE-2024-40711 | Veeam Backup Enterprise Manager | Deserialization of Untrusted Data (CWE-502) | Critical (9.8) | Patched |
| CVE-2024-40766 | Veeam Backup & Replication | Improper Access Control (CWE-284) | High (8.1) | Patched |
Every one of these vulnerabilities has a publicly available patch. The oldest, CVE-2020-3259, has been fixable for over six years. The fact that SafePay—described as using credential theft, phishing, and opportunistic exploitation rather than bespoke zero-days—continues to succeed with this toolkit tells us that patch latency at the network edge remains a dominant failure mode in 2026.
Why This Matters
SafePay's targeting pattern reveals a deliberate two-layer strategy:
- Perimeter breach via Cisco VPN/firewall appliances: CVE-2020-3259 and CVE-2023-20269 affect ASA and FTD devices— the exact systems exposed to the public internet and frequently left on outdated firmware in branch offices and SMB environments.
- Recovery sabotage via Veeam vulnerabilities: CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 all target Veeam's backup stack. Compromising backup infrastructure first ensures that when encryption hits, restoration from clean copies is difficult or impossible— increasing ransom payment pressure.
The combination of edge device exploitation followed by backup system compromise is not coincidental. It's a calculated playbook designed to maximize leverage by eliminating the victim's most reliable recovery path.
Shield53 assesses that organizations with exposed Cisco ASA/FTD management interfaces and reachable Veeam Backup Enterprise Manager consoles— particularly in mid-market and critical infrastructure sectors— are at highest risk. The advisory confirms SafePay operates across North America, South America, Europe, and Australia, indicating broad capability and no regional specialization.
Living Off the Land Complicates Detection
CISA notes that SafePay uses legitimate system administration tools for lateral movement and privilege escalation, then disables security controls prior to encryption. This LOTL (Living Off the Land) approach— using tools like PowerShell, WMIC, and native account management utilities— is designed to blend with normal administrative activity and evade signature-based detection.
Defenders should expect that traditional AV and EDR alerts alone may not catch this phase. Behavioral detection, particularly for anomalous credential creation, unexpected account privilege changes, and security service tampering, is essential.
Shield53 Recommendations
Immediate Actions
Strategic Measures
- Implement Zero Trust segmentation: Assume breach mentality. Restrict lateral movement with microsegmentation between VPN entry points, backup infrastructure, and production systems.
- Privilege minimization: Limit local admin accounts. Use just-in-time (JIT) access models. Monitor for new account creation events as high-fidelity alert triggers.
- Patch SLAs with teeth: CVEs with known public exploits and CISA KEV catalog entries should have 7-day remediation SLAs— not quarterly cycles. Edge devices and backup systems deserve the most aggressive timelines.
- Tabletop ransomware exercises: Include a scenario where backup infrastructure is compromised pre-encryption. Many organizations rehearse encryption but fail to plan for the moment when their recovery option is destroyed.
SafePay doesn't need innovation to win— it needs defenders to keep neglecting fundamentals. The patch for every CVE in this advisory has been available for months or years. Closing those gaps, hardening backup architecture, and implementing behavioral detection for LOTL activity will dramatically reduce SafePay's attack surface. The playbook is known. The question is whether organizations will act before or after encryption.
