On October 20, 2026, the FBI, CISA, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency and the UK’s North West Regional Organised Crime Unit published a joint advisory on SafePay ransomware, AA26-293A. It says SafePay has hit at least 600 separate victims since August 2024 and was among the most active ransomware groups in 2026. It also describes how SafePay removes recovery options before it encrypts anything, by stopping shadow copies and resetting backup storage to factory settings.

enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. What follows sets out how SafePay gets in, why backup storage is a target and the 5 checks to run across your client base.

How does SafePay get into a network?

The advisory lists 3 routes. The first is credentials: SafePay steals or guesses passwords, runs brute-force attacks and logs in through VPN access with phished accounts. The second is known flaws in firewalls and other edge devices, specifically CVE-2020-3259 and CVE-2023-20269. The third is automated scripts against internet-exposed systems, using CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.

All 5 vulnerabilities were assigned between 2020 and 2024. The advisory identifies them by CVE number rather than by product, so check each one against the firewalls, VPN gateways and internet-facing servers in your client estates. Its first key action is to patch firewalls and other edge devices.

What does SafePay do once it is inside?

SafePay gains administrative rights on existing accounts or creates new ones. It moves between systems with PsExec, WinRM, Remote Desktop Protocol and remote monitoring and management software. The advisory lists legitimate remote tools, including ScreenConnect, AnyDesk and TeamViewer, among those used for access and persistence, and it is clear that these tools are not malicious in themselves.

Before moving laterally, SafePay commonly disables security software. In some cases it changed user passwords so that valid logins stopped working. Data is compressed and taken out with tools such as RClone, WinSCP and FileZilla, and only then does encryption start.

Why does SafePay go after backup storage first?

The advisory states that SafePay halts the Volume Shadow Copy Service and resets network-attached storage containing backup data to initial factory settings, to inhibit system recovery. In some cases it deleted all network-attached backups. This happens after data is taken and before files are encrypted, so by the time a client sees the ransom note, the local restore points are already gone.

According to the advisory, files encrypted by SafePay cannot be recovered without the decryption key. The question to ask for each client is whether any backup copy sits outside the reach of an administrator account on the same network.

The 5-step MSP checklist

Work through these for every client, starting with the ones that have internet-facing firewalls or VPN gateways.

1. Patch edge devices. Check firewalls, VPN gateways and internet-facing servers for the 5 CVEs above, and prioritize known exploited vulnerabilities on internet-facing systems.

2. Isolate backup administration. Give backup systems their own admin accounts, separate from everyday domain admin accounts, with least-privilege access and a separate network segment.

3. Enforce MFA. Apply it to VPNs, webmail and every account that reaches critical systems, as the advisory recommends, and lock accounts after repeated failed logins.

4. Keep an offline copy. Hold at least one backup copy that is offline, encrypted and immutable, and test a restore from it.

5. Alert on admin changes. Review domain controllers, servers and Active Directory for new or unrecognized accounts, and alert on new admin accounts and changes to backup storage.

Steps 1 and 3 are configuration changes. Steps 2 and 4 change how backups are run, so they need planning with each client. Step 5 depends on someone watching the alerts outside office hours.

The enhanced.io SOC watches for new administrator accounts and changes to backup systems around the clock, then detects and escalates them to your team.

What should MSPs tell clients?

Once the checks pass for a client, send a short confirmation. Here is a ready-to-send line:

“We checked your backups this week against the new FBI and CISA advisory on SafePay ransomware. Your backup admin access is separated, MFA is on for remote access and an offline copy is in place and tested. We’ll tell you straight away if anything changes.”

Send it only when all 5 checks pass for that client. If one fails, tell the client what you found and when it will be fixed.

Start with the edge devices this week. They are the first entry point the advisory lists.

Key takeaways

• Joint advisory AA26-293A says SafePay has hit at least 600 victims since August 2024.

• SafePay gets in through stolen or guessed passwords, VPN access and 5 known CVEs in edge devices and internet-exposed systems.

• Before encrypting, it stops shadow copies and resets network-attached backup storage to factory settings.

• The 5 checks: patch, isolate backup administration, enforce MFA, keep an offline copy and alert on admin changes.

• Confirm the results to each client only once all 5 checks pass.

About enhanced.io

enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. We work only through MSP partners and never sell direct to end clients. To talk about how enhanced.io fits your stack, book a partnership conversation with Hannah Lloyd.