SafePay Ransomware Advisory: Protect Your Backups

On 20 October 2026, the FBI, CISA and partner agencies in the US, Germany and the UK published a joint #StopRansomware advisory on SafePay ransomware (AA26-293A). The headline for anyone who runs backups: SafePay actors deliberately go after recovery. They stop Windows shadow copies, reset network-attached storage that holds backup data to factory settings and, in some cases, delete all network-attached backups. If your only copies sit on storage the attacker can reach, they may not be there when you need them.

What the advisory says

According to the advisory, SafePay has been active since August 2024 and has hit at least 600 victims. The group runs a double-extortion model: it steals data first, encrypts systems second, and threatens to publish the stolen files on its leak site if the victim does not pay.

The ways in are familiar:

• Stolen or guessed credentials, including brute-force password attacks.
• VPN access using phished accounts.
• Known vulnerabilities: the advisory lists five, two in edge devices (CVE-2020-3259 and CVE-2023-20269) and three exploited with automated scripts on other internet-exposed systems (CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766).

Once inside, the actors use common admin and remote-access tools, disable security software such as Windows Defender, and move data out with tools such as RClone and WinSCP, and in some cases OneDrive, before encrypting.

On backups, the agencies' recommendations are direct: keep offline backups and regularly test restoration; make sure backup data is encrypted and immutable and covers the whole organisation; and keep several copies of sensitive data stored away from the main environment. They also want multi-factor authentication switched on wherever it can be, starting with webmail, VPN and critical-system accounts.

What this means for GCC customers

None of the techniques in this advisory are new, and that is the point. SafePay does not need a sophisticated exploit if a VPN account has no MFA, an edge device is unpatched, or the backup NAS shares the same admin credentials as the rest of the domain.

Three patterns are worth checking in any UAE or GCC estate:

• Backups on the same network, with the same credentials. A NAS or backup repository joined to the production domain, managed by the same administrator accounts, is reachable by anyone who has taken over the domain. A factory reset of that box is exactly what the advisory describes.
• "Immutable" that was never switched on. Many backup platforms support immutability or retention locks, but they have to be configured and covered by policy. Check that they are actually enabled, and on all critical data rather than only part of it.
• Restores that were never timed. A backup job that reports success is not the same as a recovery you have proven. For banks and regulated enterprises, the question after an incident is how long the business was down, not whether the jobs were green.

Data theft adds a second layer. Even with clean backups, double extortion means the stolen data can still be published. Recovery and data-loss prevention need to be planned together.

Practical recommendations

1. Check the five CVEs in the advisory against your VPNs, firewalls, backup servers and other internet-facing systems, and patch or isolate anything exposed.
2. Enforce MFA on VPN, webmail, remote access and every backup console.
3. Separate backup administration from everyday domain admin: dedicated accounts, least privilege, and no shared passwords with production.
4. Keep at least one copy offline or immutable, ideally in a separate location, and confirm the setting is actually applied to every critical workload.
5. Run a timed restore test of one critical system this quarter and record how long it took.
6. Watch for the behaviours the advisory describes: security tools being disabled, shadow copy services stopped, and unexpected bulk uploads to file-transfer or cloud-storage tools.

Our 3-2-1 backup rule guide explains how to structure the copies. If you run NetBackup or Cohesity, our engineers can review immutability, isolation and access controls on your NetBackup or Cohesity environment. For a broader review, see our data backup services in Dubai.

FAQ

Does this advisory apply to organisations in the GCC?

The advisory is published by US, German and UK agencies, and it names victims in North America, South America, Europe and Australia. The techniques and mitigations apply to any enterprise network, wherever it is.

Are cloud backups enough to protect against SafePay?

Only if an attacker who controls your domain or admin accounts cannot delete or change them. Check that the cloud copy uses separate credentials, MFA and retention that cannot be shortened, and test how long a large restore would take over your link.

What is the first thing to check this week?

Whether the accounts that manage your backup storage are the same accounts that manage your domain. If they are, separating them and enabling MFA is a quick, high-value fix.

Want a second opinion on how your backups would survive an attack like this?

Talk to a Virtech backup engineer: call or WhatsApp Virgil on +971 55 700 8578, or email sales@virtech.ae.

Sources: CISA: #StopRansomware: SafePay Ransomware (AA26-293A) · FBI IC3 advisory PDF