SafePay Shows How Old Vulnerabilities Still Open New Doors
On October 20, 2026, the FBI, CISA, and international partners released a joint #StopRansomware advisory on the SafePay ransomware group. SafePay has impacted at least 600 victims across critical infrastructure sectors since August 2024 and ranks among the most active ransomware groups of 2026.
The most telling detail is how familiar the entry points are. The advisory names five CVEs, all disclosed in 2024 or earlier. Three affect VPN and firewall appliances, and two affect Veeam backup software. For SafePay, known gaps that were never closed proved to be enough.
Why This Advisory Hits MSPs Directly
At PC Matic, we see SafePay as a clear case for treating vulnerability intelligence as an operational priority, and several details in the advisory land squarely on MSPs. The first is patch lag. Across dozens of client environments, edge devices and backup servers are often the hardest systems to keep current because updates are change-sensitive and easy to push to next quarter. SafePay targets exactly that window.
Backups are another primary objective. The advisory describes operators stopping the Volume Shadow Copy Service, resetting backup NAS devices to factory settings, and in some cases deleting all network-attached backups.
SafePay also relies on the same tools MSPs use every day, including ScreenConnect for persistence and access, and AnyDesk or TeamViewer to deliver ransomware. In an MSP environment, that activity can blend in with legitimate administration.
Three Steps to Close the Gaps SafePay Exploits
Prioritize by active exploitation, not base score
Check every client’s edge and backup infrastructure against CISA’s Known Exploited Vulnerabilities catalog, starting with the five CVEs in AA26-293A. Base scores can mislead here: one of those CVEs scores just 5.0, yet it helps attackers brute-force VPN logins. Patch internet-facing systems first, and treat any device found behind as potentially compromised until its logs have been reviewed.
Separate backups from the production identity
Keep at least one offline or immutable backup copy under credentials that don’t live in the client’s Active Directory, so a stolen domain admin account can’t reach every copy. Then run a restore test. A backup that hasn’t been restored hasn’t been proven.
Close password-only remote access
Require MFA on every VPN, clientless portal, RDP gateway, and remote support tool, and enforce account lockout to block brute-force attempts. Inventory the remote access software on client endpoints and allow only the tools your team actually uses.
Turning Vulnerability Intelligence Into Policy With PC Matic MSP
PC Matic MSP‘s Real-Time CVE Policy Controls deliver real-time vulnerability threat intelligence, so your team can quickly focus on the vulnerabilities that matter and plan how to mitigate them across your clients.
That intelligence sits on top of default-deny application allowlisting, which blocks unknown software before it can execute. In a SafePay-style intrusion, an unrecognized ransomware payload can’t run, unapproved remote tools are treated like any other unknown executable, and script enforcement limits the command-line activity attackers use to move laterally.
From Backlog to Control
SafePay is a reminder that most ransomware still walks through known doors. MSPs that pair real-time vulnerability intelligence with default-deny execution control can close those doors faster and keep attackers from acting while patches roll out.
Learn more about the PC Matic MSP program today.
