SafePay Ransomware Joint Advisory: Five Exploited Flaws and How to Close Them

A joint advisory from multiple agencies details the SafePay ransomware group’s widespread activity since August 2024 (≈600 victims), describing access via stolen/guessed credentials, brute force, VPN abuse, and exploitation of five known CVEs affecting edge and backup products; attackers exfiltrate data (using tools like RClone, WinSCP, FileZilla, Backblaze b2.exe) before encrypting files and posting uncooperative victims’ data on a leak site. The advisory lists fixed versions for each CVE, recommends immediate patching, MFA for VPNs, hardened passwords, offline immutable backups, network segmentation, EDR monitoring, and treating internet-exposed systems as potentially compromised.