INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FBI Identifies SafePay Ransomware Gang as Active Threat Since 2024

| 2026-10-20 20:27 CRITICAL HIGH RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
The SafePay ransomware gang has been actively targeting businesses and critical infrastructure in Europe since August 2024, with over 600 victims reported to date. The FBI and cybersecurity agencies in Germany as well as the U.K. attribute this activity to SafePay, a group that uses tactics such as guessing passwords, exploiting vulnerabilities, and phishing attacks. These operations typically involve establishing control within networks by creating new accounts or taking over existing ones, then using legitimate system tools to move through the network and identify valuable files. The attackers also use automated scripts to target vulnerabilities across internet-exposed systems, often changing user passwords to make it harder for victims to login and stop their activity. As of 2026, SafePay is considered one of the most active ransomware groups in Europe, with its leak site listing dozens of German companies as well as government organizations across Latin America and the U.S.
Technical Mitigations AI-generated
• Patch CVE-2020-3259 and other listed vulnerabilities to prevent exploitation by SafePay ransomware gang. • Block or hunt for legitimate remote desktop tools like AnyDesk or TeamViewer, which are used to transfer ransomware onto victim systems. • Detect and monitor for phishing attacks and password guessing attempts by the SafePay group.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2020-3259CVE-2020-3259 CVE-2024-40711CVE-2024-40711 CVE-2023-27532CVE-2023-27532 CVE-2024-40766CVE-2024-40766 CVE-2023-20269CVE-2023-20269
Target & Sectors
LATAM LATAM DACH DACH FIVE_EYES FIVE_EYES governmentgovernment
Incident Timeline
‎August 2024
The SafePay ransomware gang used legitimate remote desktop tools like AnyDesk or TeamViewer to transfer ransomware onto victim systems.
tactic Ransomware
At least 600 organizations across the U.S. and Europe have been breached by the SafePay ransomware gang since August 2024, according to a new advisory from international law enforcement agencies.
victims 600 victims
At least 600 organizations across the U.S. and Europe have been breached by the SafePay ransomware gang since August 2024, according to a new advisory from international law enforcement agencies.
target_region EUROPE
At least 600 organizations across the U.S. and Europe have been breached by the SafePay ransomware gang since August 2024, according to a new advisory from international law enforcement agencies.
organisation AnyDesk
Legitimate remote desktop tools like AnyDesk or TeamViewer are used to transfer ransomware onto victim systems.
organisation TeamViewer
Legitimate remote desktop tools like AnyDesk or TeamViewer are used to transfer ransomware onto victim systems.
financial $80 settlement
Conduent announced a $80 million settlement last Friday in response to a class action lawsuit filed in the wake of the ransomware attack.
organisation CVE-2020-3259
The advisory lists multiple vulnerabilities the group has used in attacks, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532 , CVE-2024-40711 , CVE-2024-40766 and others.
organisation CVE-2023-20269
The advisory lists multiple vulnerabilities the group has used in attacks, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532 , CVE-2024-40711 , CVE-2024-40766 and others.
organisation CVE-2023-27532
The advisory lists multiple vulnerabilities the group has used in attacks, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532 , CVE-2024-40711 , CVE-2024-40766 and others.
organisation CVE-2024-40766
The advisory lists multiple vulnerabilities the group has used in attacks, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532 , CVE-2024-40711 , CVE-2024-40766 and others.
organisation Medicaid
The SafePay attack on Conduent caused significant damage across the U.S. because of the company’s role in Medicaid, child support, food assistance, roadway tolls and more.
‎2026/10/20
The SafePay ransomware gang has targeted more than 600 victims since 2024.
organisation SafePay
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024.
victims 600 victims
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024.
Tactical Metrics
Metrics
victims
600
Victims
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024.
At least 600 organizations across the U.S. and Europe have been breached by the SafePay ransomware gang since August 2024, according to a new advisory from international law enforcement agencies.
Metrics
financial
80,000,000
Settlement
Conduent announced a $80 million settlement last Friday in response to a class action lawsuit filed in the wake of the ransomware attack.
Intelligence Sources
TheRecord 2026-10-20