SafePay Ransomware Is Targeting VPNs, Backups and OneDrive: What Businesses Should Check

A newly released international cybersecurity advisory provides an unusually clear picture of how modern ransomware operators get into business networks, quietly expand their access and undermine recovery before encrypting files.

The advisory focuses on SafePay ransomware, one of the most active ransomware operations of 2026. Investigations by the FBI, CISA, U.S. Secret Service and law-enforcement agencies in Germany and the United Kingdom have identified at least 600 affected organizations across multiple industries and continents.

SafePay is especially relevant to small and midsize businesses because its operators do not depend on one sophisticated zero-day vulnerability. They combine exposed VPN access, stolen or weak passwords, older unpatched security flaws and legitimate administrative tools already present in many business environments. [1]

For Southwest Florida businesses, this is a reminder that ransomware prevention requires more than antivirus software. Firewalls, identities, remote-support tools, Microsoft 365, servers and backups must work together as one security and recovery system.

How a SafePay attack begins

Investigators have observed SafePay operators obtaining initial access through:

• Stolen or exposed credentials
• Password-guessing and brute-force attacks
• Phished VPN account profiles
• Vulnerable firewalls and other internet-facing devices
• Automated exploitation of known vulnerabilities
• Phishing and social engineering

The advisory identifies several older vulnerabilities used against edge devices and backup systems, including:

• CVE-2020-3259
• CVE-2023-20269
• CVE-2023-27532
• CVE-2024-40711
• CVE-2024-40766

The dates matter. These are not all brand-new vulnerabilities. Attackers continue to succeed because internet-facing systems and backup platforms can remain unpatched long after fixes become available.

A business therefore needs to know more than whether monthly Windows updates were installed. Its vulnerability-management program must include firewalls, VPN appliances, backup servers, remote-access platforms, network equipment, applications and unsupported devices.

What happens after the attackers get inside?

SafePay operators attempt to become administrators, either by taking over existing accounts or creating new ones. They then use legitimate Windows and remote-administration capabilities to move throughout the network.

Observed tools and methods include:

• PowerShell
• PsExec
• Windows Remote Management
• Remote Desktop Protocol
• ScreenConnect
• AnyDesk
• TeamViewer
• FileZilla
• WinSCP
• 7-Zip and WinRAR
• RClone
• OneDrive
• Network-share discovery tools

Many of these products have valid business purposes. Their presence alone does not prove an attack.

That is precisely what makes this activity difficult to detect. A criminal using an approved remote-support application or Microsoft-signed Windows utility can resemble a technician performing normal work. Security teams must evaluate the user, device, time, command, destination and surrounding activity—not merely the application’s name.

Investigators report that SafePay operators also disable security products, change user passwords and use administrative protocols to reach additional computers. They search network shares for valuable information before stealing and encrypting it. [1]

Why Microsoft 365 and OneDrive require monitoring

The advisory reports that SafePay operators have sometimes used OneDrive to remove stolen data from victim environments.

This does not mean OneDrive is inherently unsafe. It means a familiar cloud service can be abused after an attacker obtains sufficient account or device access.

Traditional monitoring may trust Microsoft cloud traffic because businesses regularly use OneDrive. Effective Microsoft 365 monitoring should therefore examine behavior, including:

• Unusually large upload volumes
• New synchronization activity from servers
• OneDrive use by accounts that do not normally use it
• Sign-ins from unfamiliar locations or devices
• Sudden creation of large archives before uploads
• Multiple sensitive folders accessed in a short period
• New application permissions or app passwords
• Risky sign-ins followed by file downloads or sharing changes

Microsoft 365 audit logs should be retained long enough to support an investigation. If the organization only begins collecting logs after ransomware appears, important evidence may already be unavailable.

The attack on recovery systems

SafePay does not stop at encrypting everyday files.

Investigators have seen the operators halt the Windows Volume Shadow Copy Service and reset network-attached storage containing backups to factory settings. In some cases, network-accessible backups were deleted entirely. [1]

This exposes a dangerous gap between “we have backups” and “we can recover.”

A backup is not adequately protected if an attacker using a compromised administrator account can:

• Sign into the backup console
• Delete backup jobs or retention copies
• Reset the storage appliance
• Disable immutable storage
• Change backup credentials
• Remove cloud repositories
• Encrypt the backup server
• Erase the same files used for production recovery

CISA and its partners recommend offline backups, immutable encrypted copies, separate and segmented storage, multiple recovery copies and regular restoration testing. [1][3]

For a dental office, restaurant group, property-management company or contractor, a successful restore test should answer a practical question: How long will it take to recover the systems needed to serve customers and collect revenue?

Who should take this advisory seriously?

The recommendations are relevant to almost every organization with Windows computers, remote access or shared data. Priority attention is warranted for organizations that:

• Permit remote VPN access
• Operate an internet-facing firewall or security appliance
• Use Active Directory
• Use RDP, ScreenConnect, AnyDesk, TeamViewer or similar tools
• Maintain local servers or network-attached storage
• Depend on Microsoft 365 and OneDrive
• Use Veeam or another centralized backup platform
• Have old appliances or unsupported software
• Share administrator accounts
• Have never tested a full restoration
• Cannot quickly identify every privileged account

Healthcare practices, legal firms, financial organizations and government entities must also consider whether stolen information could trigger contractual, regulatory, insurance or breach-notification obligations.

What businesses should do now

1. Inventory every external entrance

Document all externally accessible systems, including:

• Firewalls and VPN gateways
• Remote Desktop gateways
• Remote-monitoring platforms
• Backup portals
• Email and Microsoft 365 accounts
• Cloud-administration consoles
• Vendor-support connections
• Website and application administration panels

Confirm the owner, software version, authentication method and logging status of each system.

2. Prioritize exploited vulnerabilities

Patching should be based on risk, not merely age or convenience.

Internet-facing vulnerabilities included in CISA’s Known Exploited Vulnerabilities Catalog should normally receive higher priority than an unexploited issue on an isolated computer.

Ask the IT provider to document whether the five vulnerabilities identified in the SafePay advisory apply to the environment. A statement that systems are “automatically patched” is not sufficient evidence.

3. Secure remote access

Require MFA for VPN, webmail, remote-support platforms and accounts that reach critical systems.

Also:

• Disable unused remote-access services
• Restrict access by geography or trusted source where practical
• Review failed and successful VPN sign-ins
• Remove inactive accounts
• Avoid shared technician credentials
• Require approval for new remote-support tools
• Alert on unexpected after-hours administrative sessions

4. Review administrator accounts

Examine Active Directory, Microsoft 365, firewalls, servers, backup platforms and remote-management systems for:

• New or unrecognized accounts
• Dormant administrators
• Unexpected group-membership changes
• Service accounts with excessive permissions
• Accounts without MFA
• Passwords shared between systems
• Privileged accounts used for normal email or web browsing

Administrative access should be granted only when needed and removed when the task is complete.

5. Monitor legitimate tools for suspicious use

Blocking every copy of PowerShell, RClone, OneDrive, ScreenConnect or 7-Zip may interrupt legitimate operations.

Instead, create behavioral alerts for events such as:

• A new remote tool installed by an ordinary user
• PowerShell downloading or launching unfamiliar code
• RClone appearing on a system where it has never been used
• Large archives created on a file server
• Remote execution across multiple computers
• Security software being disabled
• New scheduled tasks or services
• Unusual OneDrive uploads from a server
• Backup services stopping unexpectedly

6. Validate the backup design

Confirm that the organization has:

• Multiple recovery copies
• At least one isolated or immutable copy
• Separate backup-administrator credentials
• MFA on backup administration
• Alerts for deletion and configuration changes
• Documented recovery priorities
• Tested restoration procedures
• A copy of critical recovery information outside the normal network

A dashboard showing successful backup jobs does not prove that the business can restore complete, clean and usable systems.

7. Test incident response before an emergency

Business owners and managers should know:

• Who has authority to disconnect systems
• Who contacts the cyber-insurance carrier
• Which incident-response firm will be called
• Who preserves evidence
• Who advises on legal and notification requirements
• How employees will communicate if email is unavailable
• Which business service must be restored first
• Who communicates with customers and vendors

The federal advisory recommends isolating compromised hosts, collecting evidence, scoping affected accounts and devices, and creating a systematic eviction plan before broadly removing the attacker. [1]

How AI can help

Approved AI-assisted security tools can help defenders analyze large amounts of activity more quickly. Useful applications include:

• Correlating VPN, Microsoft 365, endpoint and firewall events
• Summarizing unusual administrative activity
• Identifying previously unseen remote-access software
• Detecting changes in OneDrive upload behavior
• Building a timeline across multiple systems
• Mapping observed events to SafePay tactics
• Prioritizing hosts and accounts for human review
• Drafting executive incident summaries
• Comparing the environment with a security baseline

AI can also help reduce alert fatigue by grouping related events. For example, an unusual VPN login, new administrator account, PowerShell session and large OneDrive upload may be more meaningful together than as four separate alerts.

Where human judgment remains essential

AI should not independently:

• Declare the environment clean
• Delete suspicious files
• Disable large groups of users
• Shut down business-critical servers
• Rebuild evidence-bearing systems
• Notify customers or regulators
• Decide whether to pay a ransom
• Determine whether a breach legally occurred
• Restore systems into production

Legitimate tools can create false positives, and incomplete logs can create false confidence. Experienced professionals must validate the evidence, preserve forensic information, assess operational consequences and coordinate legal, insurance and regulatory decisions.

Confidential logs, credentials, patient information, financial records and customer data should never be submitted to an unapproved public AI service.

How Managed Intelligence Advisors can help

Managed Intelligence Advisors helps Southwest Florida organizations evaluate ransomware exposure as a business-continuity problem—not simply an antivirus problem.

A SafePay-focused readiness review can include:

• External attack-surface inventory
• Firewall and VPN security assessment
• Known-exploited-vulnerability review
• Microsoft 365 and OneDrive logging assessment
• Administrative-account and MFA review
• Remote-support-tool governance
• EDR, SIEM and SOC coverage analysis
• Backup immutability and credential-separation review
• Representative restoration testing
• Network-segmentation recommendations
• Incident-response tabletop exercise
• Executive, insurance and compliance documentation
• Secure planning for AI-assisted monitoring

The objective is to determine whether attackers can enter, how quickly suspicious behavior would be detected, whether they could reach critical systems and whether the business can recover without relying on the attacker.

Call to action

Would your current security controls detect a legitimate remote-support tool being used by a ransomware operator?

Managed Intelligence Advisors can conduct a focused ransomware-readiness review covering remote access, identities, Microsoft 365, monitoring and backup recovery.

Contact Managed Intelligence Advisors to schedule an assessment.