Your Backups Are the Target Now: What This Week's SafePay Ransomware Advisory Means for Your Business
On October 20, 2026, the FBI, CISA, the U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom issued a joint cybersecurity advisory on a ransomware operation called SafePay. The group has compromised at least 600 organizations across North America, South America, Europe, and Australia since August 2024, and the agencies describe it as one of the most active ransomware operations of 2026.
SafePay gets in the way a lot of ransomware groups do guessed or stolen passwords, phishing, and known vulnerabilities in internet-facing equipment. The advisory specifically names flaw in Cisco ASA and FTD devices, SonicWall SonicOS firewalls, and notably Veeam Backup & Replication software. That last one is the detail worth sitting with. SafePay isn't just getting into networks through backup infrastructure; once inside, it goes after backups directly. The group is known to delete Windows shadow copies, disable the Volume Shadow Copy service, wipe or reset network-attached storage devices holding backup data, and use built-in Windows tools like vssadmin and bcdedit to make recovery harder. Only after it has quietly stolen data and crippled recovery options does it deploy the actual encryption and demand payment, often threatening to leak stolen files on top of it.
The timing matters, too. This advisory landed in the middle of what security researchers are now calling "Black October" a stretch of the month that saw PHP ship emergency patches for two critical, unauthenticated remote-code-execution flaws (nicknamed PHP2Shell) affecting an estimated tens of millions of exposed systems, alongside a wave of actively exploited bugs in Ivanti, Citrix, Fortinet, and other widely used network and security products. Researchers and government agencies, including CISA and international partners, have pointed to AI tools as a factor accelerating both vulnerability discovery and exploit development on both sides of the fight. Verizon's 2026 Data Breach Investigations Report found that only about 26% of known, actively exploited vulnerabilities get fully patched down from 38% the year before. Put simply, the volume of serious threats is rising, the window to patch is shrinking, and the gangs exploiting that gap are now specifically engineering around the recovery plan businesses assume will save them.
Why This Matters If You're Not a Fortune 500 Company
It's easy to read "600 victims" and assume this is an enterprise problem. It isn't. Smaller and mid-sized organizations are frequently softer targets precisely because they're less likely to have dedicated security staff watching firewall and backup-server patch levels, and ransomware crews know it. A single unpatched VPN appliance or an internet-exposed backup console is just as exploitable at a 40-person company as it is at a Fortune 500 firm arguably more so, since there's often no one checking.
The deeper lesson from SafePay isn't really about any one piece of software. It's that "we have backups" has quietly stopped being enough. If your backup repository is reachable from your production network with the same credentials an attacker can steal, if nobody has actually tried restoring from it in the last six months, or if it isn't patched as rigorously as your email server, it's not a safety net it's just another system waiting to be found.
What To Actually Do About It
The agencies' advisory, echoed in SANS Institute's own ransomware preparedness guidance, boils down to a handful of concrete, achievable steps none of which require an enterprise security budget:
- Isolate and harden backups. Follow the 3-2-1-1-0 approach: three copies of your data, on two different types of media, with one copy offsite and one copy immutable (meaning it literally cannot be altered or deleted, even by an administrator account), and zero errors on your most recent restore test. Backup management consoles should never share credentials or network access with the rest of your production environment.
- Test your restores, not just your backups. A backup you've never actually restored from is a theory, not a plan. Schedule real recovery drills on a regular cadence and treat a failed test as the emergency it is.
- Patch internet-facing systems first. VPNs, firewalls, and backup software are now front-line targets, not back-office infrastructure. If your organization or your IT provider isn't tracking patch levels on these specific systems, that's the first gap to close.
- Enforce multi-factor authentication everywhere remote access exists, including VPN, RDP, and any cloud or admin console, with no exceptions carved out for "legacy" local accounts.
- Limit who can touch backup infrastructure. Treat backup administration as a privileged function not a convenience.
The Compliance Angle You Can't Ignore
For businesses operating under HIPAA, CMMC, FERPA, or simply trying to align with frameworks like the NIST Cybersecurity Framework or the CIS Critical Security Controls, this isn't just good hygiene it's documentation examiners and auditors increasingly expect to see. NIST CSF's "Recover" function and CIS Control 11 (Data Recovery) both specifically call for tested, protected backup processes, not just backups that technically exist. If your last contingency plan review predates this year's wave of ransomware advisories, it's worth revisiting before an auditor or an attacker makes you.
The Bottom Line
This week's advisory is a reminder that resilience planning must assume the backup itself is a target, not just a fallback. For SMBs without a dedicated security team, that's exactly the kind of gap a trusted IT and cybersecurity partner exists to close reviewing where backups live, who can reach them, and whether they'd survive a real attack, before you're forced to find out the hard way.
Related Resources
