decrypted · 22 october 2026 · ransomware and cybercrime · vulnerabilities and patching · ai and llm security

SafePay's playbook is published, and the defences it points to are dull

A ransomware gang that has hit at least 600 organisations has had its methods published by agencies on both sides of the Atlantic, and the UK's National Crime Agency put its name to the document. It gets in with passwords, remote access and unpatched firewalls, then borrows your own tools. That is the useful part for a director: nothing here needs a clever defence, only dull decisions made early.

What the advisory says

The joint advisory, numbered AA26-293A and released on 20 October, is co-authored by the FBI, CISA, the US Secret Service, a German state police agency, the National Crime Agency and the North West Regional Organised Crime Unit. It says SafePay has been active since August 2024, with victims across North America, South America, Europe and Australia. The Record reports that the group's leak site lists dozens of German companies.

How it gets in, and what it does next

Picture a building where the front door is sound but the keys are lying about. The advisory lists exposed or phished credentials, brute-forced passwords, VPN logins from rented Mullvad addresses, and automated scripts that probe internet-facing systems. It names five CVEs, the public reference numbers for known flaws: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. It describes the first two only as edge device products.

Once inside, the group creates accounts or takes over existing ones, then moves using PsExec, WinRM and remote tools such as ScreenConnect, AnyDesk and TeamViewer, all of which look like routine IT work. It disables security software and sometimes changes users' passwords so the real owners are locked out. Data is zipped and copied out with tools like RClone and WinSCP before anything is encrypted. It also halts the Volume Shadow Copy Service and factory-resets backup devices on network-attached storage, the file servers in a box where many small firms keep their only copy.

What the defender sees

An admin tool running at 3am, a new account, a large archive leaving for cloud storage, a backup box resetting itself. Each is explainable alone; together they are a timetable. The demand is unusual too: a share of company revenue, with a representative phoning victims to apply pressure. The advisory says data encrypted by this variant cannot be recovered without the key.

The Secure by Design lesson

Every step above leans on something a product or procurement decision allowed: remote tools any user can install, backups a compromised administrator can wipe, edge devices left unpatched for years. Secure by Design asks suppliers to ship safe defaults, and asks buyers to insist on them. In practice:

Put multi-factor authentication, a second check on top of the password, on every remote route.
Keep one offline or immutable backup that no domain administrator can reach.
Allow-list the remote tools your IT team really uses, and alert on the rest.
Patch entries on CISA's known exploited vulnerabilities list first, starting with internet-facing kit.

None of this costs much next to a revenue-share demand. Opinion, not advice.

Also this week

Plex2Shell. On 20 October CISA added four Plex Media Server flaws to its exploited list: CVE-2026-96652 and CVE-2026-96655 (both server-side request forgery, where a server is tricked into fetching things for an attacker), plus CVE-2026-96654 and CVE-2026-96656. A secondary summary of The Hacker News says researcher Zach Main showed they can be chained into remote code execution, running an attacker's code on your machine, without a login, that version 1.43.3.10861 fixes them, and that miners and proxy malware are being planted. I could not verify that last claim independently. The practical question is wider than Plex: ask whether any unmanaged box on your estate, a media server included, can be reached from the internet, and who is responsible for patching it. Small utilities installed for convenience are where patching processes tend to run out.

AI plumbing has ordinary flaws. Not new this week, but useful context: Google's threat intelligence group tracked 2,076 AI-related CVEs between January 2025 and August 2026, over 1,500 of them this year, with half in agent orchestration frameworks such as Flowise and Langflow. Only a handful are confirmed exploited, including a LiteLLM command injection, CVE-2026-42271, that leads to host takeover and API credential theft. Google says it has not yet seen zero-day exploitation of AI infrastructure. The same report counts 141 vulnerabilities exploited between January and August 2026, against 127 in all of 2025, and says 0.23% of this year's disclosures were seen exploited. The dangerous few are knowable, which is why a known exploited list is worth more than a severity score. Treat your AI gateway like any internet-facing server: behind logins, and patched.

Sources

If you want help turning this into a plan for your own systems, get in touch.