Patch Veeam and SonicWall Systems to Block SafePay Ransomware Access

SafePay ransomware operators are actively destroying backup systems and encrypting data across critical infrastructure sectors, according to a joint advisory from CISA and international partners. The campaign has impacted at least 600 organizations since August 2024, using a combination of stolen credentials, phishing, and automated exploitation scripts to breach networks in North America, South America, Europe, and Australia.

The October 20, 2026 advisory highlights that attackers prioritize disabling recovery capabilities. They target specific vulnerabilities in internet-facing systems, including CVE-2024-40711 in Veeam Backup & Replication and CVE-2024-40766 in SonicWall SonicOS. Once inside, they use legitimate administration tools to move laterally, steal data, and obstruct restoration efforts before deploying encryption payloads.

What we know

Investigators identified five exploited vulnerabilities spanning authentication failures, unsafe deserialization, and improper access controls. CVE-2024-40711 allows unauthenticated remote code execution with a critical CVSS score of 9.8. CVE-2024-40766 affects SonicWall management access, potentially causing firewall crashes. Other exploited flaws include CVE-2020-3259, CVE-2023-20269, and CVE-2023-27532.

Attackers establish persistence by creating accounts or hijacking existing administrative privileges. They use PsExec, Windows Remote Management, and Remote Desktop Protocol for command execution. Tools like ShareFinder.ps1 and SharpShares.exe help enumerate network shares for data theft. Operators also bypass User Account Control and impersonate tokens to escalate privileges.

Defender's checklist

• Verify if Veeam Backup & Replication or SonicWall SonicOS systems are exposed to the internet.
• Check logs for unauthorized administrative account creation or use of PsExec and RDP.
• Ensure backup systems are isolated and not accessible via unauthenticated remote code execution paths.
• Monitor for connections originating from Mullvad VPN addresses or unusual remote access tool usage.

What analysts watch for

Teams usually examine how malware arrives via exposed credentials or vulnerable remote services. Analysts check whether attackers persist by creating shadow administrator accounts or abusing legitimate tools like Remote Desktop Protocol. They look for signs of lateral movement using scripts that enumerate network shares. Investigators also verify if backup infrastructure was targeted for deletion or encryption. Monitoring for unusual process execution and privilege escalation attempts helps identify early intrusion stages before data exfiltration occurs.

What to do and how to stay safe: SafePay

• Audit internet-facing systems for unpatched versions of Veeam Backup & Replication and SonicWall SonicOS.
• Review administrative account activity for unauthorized creations or privilege escalations.
• Verify the integrity and accessibility of offline backup systems regularly.
• Monitor network traffic for connections to known malicious IPs or unusual remote access tool usage.

Step-by-step guide: How to Implement Antivirus Software Without Breaking Your Stack

General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific vulnerabilities are SafePay operators exploiting?

The advisory identifies CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766 as exploited weaknesses.

How do SafePay attackers enter networks?

They gain entry through exposed credentials, phishing, brute-force attacks, and internet-accessible vulnerable systems, often using automated scripts.

What impact does SafePay have on backup systems?

SafePay operators deliberately attack and destroy backup systems to obstruct recovery, combining data theft with encryption to pressure victims.