What happens when ransomware attackers don't need sophisticated new malware to bring a business to its knees?
On October 20, 2026, CISA, the FBI, the U.S. Secret Service, and international law enforcement partners issued a joint advisory about SafePay ransomware. The group has affected at least 600 organizations across multiple critical infrastructure sectors since August 2024.
But the most concerning part isn't the number of victims.
It's how attackers are getting inside businesses, using legitimate IT tools, disabling security protections, and destroying recovery options before launching ransomware.
Key Takeaway: SafePay demonstrates that ransomware is not simply a malicious software problem. Attackers can use stolen credentials and legitimate administrative tools to compromise systems, steal data, and disable defenses. Businesses need prevention controls that restrict unauthorized endpoint behavior, even when the attack itself has not been identified.
The joint CISA/FBI advisory AA26-293A describes SafePay as one of the most active ransomware operations of 2026.
SafePay has targeted organizations across North America, South America, Europe, and Australia, including multiple critical infrastructure sectors.
Investigators documented several methods the group uses to gain access:
Once inside, attackers use legitimate Windows administration capabilities to expand their control.
They have also been observed disabling security products, stealing sensitive information, interfering with backups, and encrypting files.
This is a double-extortion operation. Victims may face both business disruption and threats to publish stolen information.
Importantly, the advisory covers observed activity, not a claim that every SafePay attack follows an identical sequence.
Because the techniques SafePay uses are not unique to SafePay.
Many organizations invest heavily in identifying malicious files, monitoring suspicious behavior, and responding to alerts.
Those protections are important. But SafePay shows how attackers can exploit legitimate access and approved administrative tools to accomplish harmful objectives.
This matters particularly when IT teams, MSPs, and outside vendors rely on the same tools for ordinary business operations.
The broader research reinforces the risk.
According to the 2026 Verizon Data Breach Investigations Report:
The 2026 IBM Cost of a Data Breach Report estimates the global average breach cost at $4.99 million. That is a cross-industry average, not a SafePay-specific loss estimate.
For an individual business, the consequences can include interrupted operations, lost productivity, restoration expenses, customer notification requirements, and reputational damage.
For critical infrastructure operators, an IT outage may also disrupt essential services.
SafePay uses trusted administration and file-management tools for activities that normally belong to authorized IT personnel.
CISA documents abuse of technologies including:
None of these tools is automatically malicious.
That is exactly the problem.
An authorized administrator might use PowerShell to maintain a system. An attacker with compromised credentials might use the same application to prepare a ransomware attack.
The executable may be legitimate. The user account may appear valid.
What matters is what the application is being allowed to do.
For business leaders, this raises an important question: Are endpoint controls evaluating only whether software is recognized, or are they also restricting what that software can accomplish?
Yes, endpoint detection and response (EDR) technologies can detect many of the behaviors described in the advisory, particularly when suspicious activities are correlated across systems.
However, detection is not guaranteed.
Attackers may blend malicious activity with normal administration, abuse valid credentials, disable security tools, or operate before defenders have enough information to respond.
SafePay has been observed interfering with security software and using established Windows functionality to avoid detection.
That creates a dangerous dependency.
If protecting the business depends entirely on recognizing an attack, what happens when the attacker successfully avoids recognition or disables the monitoring system?
EDR remains an important component of cybersecurity. It provides visibility, investigation capabilities, and incident response.
But it should not be the only control standing between an attacker and damaging endpoint activity.
This is where Isolation and Containment can fundamentally change the defensive strategy.
Traditional detection-focused tools attempt to identify malicious activity and respond.
Isolation and Containment focus on restricting what applications and processes can do, regardless of whether they have already been classified as malicious.
Consider the actions SafePay ultimately needs to perform.
Attackers may need to execute commands, launch unauthorized processes, manipulate system resources, access sensitive files, disable protections, spread across endpoints, or encrypt business information.
Changing the attack does not necessarily change the endpoint actions the attacker ultimately needs in order to succeed.
Appropriately designed and configured containment policies can prevent or constrain particular behaviors, including unauthorized process launches and restricted application interactions with protected resources.
That can reduce the attacker's freedom to operate and limit the damage from a compromised endpoint.
AppGuard is a proven endpoint protection solution with more than a decade of production history focused on prevention through Isolation and Containment.
Rather than requiring every threat to be identified as malicious first, AppGuard applies controls intended to restrict out-of-bounds application and process behavior.
This can complement EDR by limiting opportunities for certain attacks to execute damaging actions.
There are important boundaries: endpoint containment does not automatically prevent credential theft elsewhere, eliminate network vulnerabilities, or stop every form of data exfiltration. Control effectiveness depends on configuration, privileges, attack paths, and the systems being protected.
But it changes the security question from Can we recognize every attack? to Can we restrict the actions attackers need to succeed?
Because attackers understand that reliable backups reduce their leverage.
CISA reports that SafePay has interrupted the Windows Volume Shadow Copy Service and reset network-attached storage devices containing backup data.
The objective is straightforward: Make recovery more difficult and increase pressure on victims to pay.
This makes backup security a business continuity issue, not simply an IT maintenance task.
Organizations need recovery copies attackers cannot readily modify or erase using compromised production credentials.
They also need to test whether business-critical applications can actually be restored within acceptable timeframes.
Preventing ransomware encryption remains important. Preserving recovery options is equally essential when prevention fails.
SafePay offers several practical lessons that apply well beyond critical infrastructure.
These recommendations align with the CISA SafePay advisory and reinforce the need for layered defenses.
The most important takeaway from SafePay is not that another ransomware group has become successful.
It's that familiar attack techniques continue to create serious business consequences.
Stolen credentials, trusted applications, administrative tools, disabled security products, and compromised backups remain effective components of ransomware operations.
Detecting these threats is valuable. Responding quickly is essential.
But businesses should also ask whether attackers can be prevented from performing the damaging actions in the first place.
Unknown does not automatically mean unstoppable.
The objective is not to predict every attack. It is to restrict the actions an attacker needs in order to succeed.
For further background, read our related article: When Trusted Windows Drivers Become Weapons Against Your Security.
Primary source: CISA, FBI and international partners: #StopRansomware SafePay Ransomware, October 20, 2026.