The FBI and CISA issued a joint advisory in October 2026 warning that SafePay ransomware has become one of the world’s most active ransomware operations, striking over 600 critical infrastructure providers since 2024. SafePay’s victim list includes Ingram Micro, the California-based technology distributor whose July 2025 breach disrupted order processing for days and exposed personal data belonging to more than 42,000 people.
The attack chain the agencies describe follows a pattern we’ve seen hundreds of times: compromised credentials or exploited vulnerabilities provide initial access, lateral movement via RDP and legitimate Windows tools like PsExec, data exfiltration using FileZilla and RClone, and finally encryption of files across the network.
What makes SafePay notable isn’t innovation — it’s persistence and scale. The scumbags behind it know that most organizations are playing whack-a-mole: patch this CVE, update that signature, hope your EDR catches the next variant. SafePay keeps working because it exploits the gap between when a new technique appears and when your security stack learns to recognize it.
Why the SafePay Attack Chain Works
SafePay actors gain initial access through compromised VPN credentials or by exploiting known vulnerabilities in edge devices — the advisory specifically mentions CVE-2020-3259 and CVE-2023-20269. Once inside, they use Windows Remote Management and PsExec to execute commands on remote systems, disable security software, and move laterally via RDP.
The data theft phase uses tools that IT staff use every day: FileZilla for file transfers, 7-Zip and WinRAR for compression, WinSCP and RClone for exfiltration to attacker-controlled cloud storage. These are legitimate programs. Your antivirus isn’t going to flag them. Your DLP might catch some of it if you’ve tuned the rules perfectly and the attacker didn’t password-protect the zip file (they did).
Then comes encryption. The ransomware payload — already delivered and executed — begins writing encrypted versions of your files to disk. By the time you notice, it’s too late. Your backups might save you if they’re offline and immutable. Or you’re negotiating with the people who just stole 42,000 records.
How FileSure Would Have Blocked SafePay at the Delivery Stage
FileSure Defend doesn’t try to recognize SafePay or any other ransomware variant. It operates at the Windows kernel level and controls what programs are allowed to do to your files — before the operation completes.
Here’s a specific rule configuration that would have stopped SafePay at the earliest point in the attack chain:
File name filter: *.exe, *.dll, *.bat, *.ps1, *.vbs, *.scr
Program name filter: All programs except authorized system management tools and approved deployment accounts
Operations: Write, Create
Drive type: Hard drives, Network drives
Result: Block and log
When the SafePay payload arrives via the compromised RDP session or exploited VPN connection, it has to write itself to disk before it can execute. That write operation is intercepted by FileSure’s kernel filter driver. The program attempting the write — whatever delivery mechanism SafePay used — is not on the authorized list. The write is blocked. The payload never lands.
No execution. No lateral movement. No data exfiltration. No encryption. The attack ends before it starts.
The same mechanism applies to the data exfiltration phase. A rule that restricts which programs can read sensitive data files would block FileZilla and RClone from accessing those files when invoked by an unauthorized account:
File name filter: *.xlsx, *.docx, *.pdf, *.mdb, *.accdb (or whatever contains your sensitive data)
Program name filter: Only authorized business applications
Operations: Read
Drive type: Hard drives, Network drives
Result: Block and log
FileZilla is a legitimate tool, but it’s not an authorized business application for accessing customer records. When the attacker tries to use it to read and upload your files, FileSure blocks the read operation and logs the attempt. Your security team gets an alert. The data never leaves the building.
Why This Works When Signatures Fail
SafePay is still active in 2026 because signature-based detection is always playing catchup. A new variant appears, a security researcher analyzes it, a signature is created, an update is pushed, and your endpoint protection learns to block it. That process takes hours or days. The attack happens in that window.
FileSure doesn’t care what the ransomware is called or what obfuscation technique it uses. It enforces a simple rule: unauthorized programs cannot write executable files to this system. Ransomware from this morning is stopped the same way as ransomware from five years ago.
The product runs on Windows Server 2003 through Server 2022 and all desktop Windows versions back to XP. If you have legacy systems — the kind that can’t be patched or upgraded because they run specialized software or control industrial equipment — FileSure protects those too. The systems SafePay specifically targets.
Ready to stop ransomware before it executes? Start your free 21-day trial at bystorm.com. No credit card required. Install it, run our test file that mimics ransomware behavior, and watch FileSure block it in real time.
Source: FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure | Cybersecurity Dive
Category: Ransomware
Tags: safepay ransomware, ingram micro breach, kernel filter driver, file system security, ransomware prevention, data exfiltration, critical infrastructure, lateral movement
