CISA, the FBI, the Secret Service and partners in Germany and the U.K. put out a joint #StopRansomware advisory (AA26-293A) on SafePay, one of the busiest ransomware crews of 2026. They’ve hit roughly 600 organizations across the Americas, Europe and Australia since August 2024. This one lands right in my wheelhouse, because the front door is the edge.
How they get in
- Stolen or guessed passwords, phishing, and VPN accounts with weak or no MFA.
- Cisco ASA/FTD: CVE-2020-3259 (info disclosure) and CVE-2023-20269 (VPN brute force/auth bypass path).
- Veeam Backup & Replication: CVE-2023-27532 and CVE-2024-40711, hit with automated scripts.
- SonicWall SonicOS: CVE-2024-40766 (improper access control).
Once inside, they make or take over admin accounts, live off the land with legit IT tools, kill security tools and backups, steal data and then encrypt.
What I’d do this week
- Patch every one of those CVEs. They’re all old. If any are still open on your edge, that’s the whole ballgame.
- Put phishing-resistant MFA on every VPN and admin login, and turn on lockout and rate limits for VPN auth.
- Keep backup consoles like Veeam off the internet and off the general LAN, in their own management segment.
- Keep at least one offline, immutable backup copy, and actually test a restore.
- Hunt for new admin accounts and remote-access tools you didn’t install. Check the IOCs in the advisory against your logs before you patch, so you don’t wipe the evidence.
Have a blessed day! And Happy Hacking!
