#StopRansomware: SafePay Ransomware
Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by…
Excerpt from the primary source: CISA Cybersecurity Advisories
Who is affected
Home users · Small businesses · Enterprises · Security professionals · Critical infrastructure
Affected technology: Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), Adaptive Security Appliance and Firepower Threat Defense, Backup & Replication, SonicWall firewalls & SMA
Why it matters
CISA lists this as exploited in the wild and known to be used in ransomware campaigns. Unpatched Backup & Replication and SonicWall firewalls & SMA systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running Backup & Replication, SonicWall firewalls & SMA, Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) and Adaptive Security Appliance and Firepower Threat Defense, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
CISA's required action for CVE-2020-3259: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." US federal civilian agencies must comply by March 7, 2024.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Government advisory
Related
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position.
Critical SonicWall Vulnerability Exploited Days After Disclosure
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.
Apply the vendor's security update for SonicWall firewalls & SMA.
SonicWall and Splunk Patch Critical Vulnerabilities
Critical and high-severity vulnerabilities could allow attackers to bypass authentication, execute arbitrary code, and elevate their privileges.
SonicWall warns of max severity SSRF flaw in SMA1000 gateways
SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances.
Source reporting says attackers are already exploiting this, so exposed SonicWall firewalls & SMA systems are at immediate risk.
Treat this as an emergency.