SafePay resets the backup NAS before it encrypts anything
The call we hear most from a SafePay victim is not about the encryption. It is about the morning after, when the recovery lead opens the backup console to start the restore and finds the appliance sitting at its out of box setup wizard. The volumes, the job history, every restore point, all of it wiped, because the NAS that was supposed to be the clean room has been reset to factory defaults. The only copy of the data still intact is the one the crew already pulled out of the network and is now holding for ransom.
That is the detail that made us stop on this actor. Deleting shadow copies is table stakes for any ransomware crew in 2026. Reaching into the backup appliance itself and wiping it back to the day it came out of the box is a different kind of discipline, and the joint advisory that landed this week says SafePay does it as standard practice.
Who SafePay is
SafePay is a financially motivated double extortion crew that has been running since roughly August 2024. It is not a ransomware as a service shop. The operators keep the encryptor and the intrusion work in house, which keeps their tooling off the leak boards that burned LockBit and ALPHV, even though the encryptor itself is a reworked fork of leaked LockBit 3.0 code. On October 20, 2026, CISA, the FBI, and the US Secret Service, with Germany's BSI and the UK's NCSC, published joint advisory AA26-293A, #StopRansomware: SafePay Ransomware. It counts roughly 600 victim organizations across North America, South America, Europe, and Australia, and names SafePay among the most active operations of 2026. The crew leans on managed service providers and critical infrastructure, so one intrusion fans out into a dozen downstream environments.
The backup appliance is the target, not a casualty
Most inhibit recovery tradecraft stops at the host. A crew deletes the Volume Shadow Copy store, stops the service that would rebuild it, and turns off Windows boot recovery so the machine cannot self heal. SafePay does all of that, and then takes one more step that the advisory calls out directly: it disrupts recovery by resetting the network attached storage devices that contain the backups. The appliance that most teams treat as the thing that survives the bad day is reset to factory settings along with everything on it.
The mechanism is mundane, which is the point. SafePay needs no NAS exploit, because by this stage it already owns the credentials. Two of the initial access flaws below hand over stored secrets rather than code execution: the Veeam configuration database disclosure spills the accounts the backup estate runs under, and the Cisco ASA memory leak carves valid session material out of the VPN appliance. With a domain or storage administrator identity in hand, the crew signs into the NAS management plane the way an administrator would and issues a factory reset through the appliance's own interface. No malware runs on the NAS. The reset is a supported administrative function, invoked by a session the device has every reason to trust.
Be precise about the novelty claim, because the sources support a narrow one and not a wild one. This is not a new MITRE technique. It still maps to T1490 Inhibit System Recovery, the same identifier as a shadow copy deletion. What is under covered is the target class. The field has spent years hardening the host recovery path and telling defenders to put backups on a separate device, and SafePay's answer is to treat that separate device as a normal administrative endpoint and wipe it through the front door. The control that fails is the assumption that a backup NAS is safe because it is a different box. It is only as safe as the credential plane and the network segment it sits in.
The five CVEs that open the door
SafePay's initial access rides a small, stable set of edge and backup flaws named in the advisory and vendor coverage. All five sit in the CISA Known Exploited Vulnerabilities catalog, which means confirmed in the wild abuse and a federal remediation obligation. The pattern is a pairing: a VPN or firewall flaw opens remote access, and the Veeam flaws then surrender the backup server the crew needs to control before it destroys recovery.
| CVE | Product | How SafePay uses it | KEV | Source |
|---|---|---|---|---|
| CVE-2024-40711 | Veeam Backup & Replication (before 12.2) | Unauthenticated deserialization to remote code execution as SYSTEM on the backup server, the host the crew most wants before it wipes recovery. | Listed | Veeam KB4649 |
| CVE-2024-40766 | SonicWall SonicOS (Gen 5/6/7 SSL-VPN) | Improper access control on the SSL-VPN interface gives unauthorized remote access straight onto the network edge. | Listed | SNWLID-2024-0015 |
| CVE-2023-20269 | Cisco ASA / FTD (remote-access VPN) | Unauthorized VPN sessions through brute force against a vulnerable profile, used to validate stolen or guessed credentials. | Listed | cisco-sa-asaftd-ravpn-auth |
| CVE-2023-27532 | Veeam Backup & Replication (before 11a / 12) | Discloses credentials stored in the Veeam configuration database, handing over the backup estate and the accounts tied to it. | Listed | Veeam KB4424 |
| CVE-2020-3259 | Cisco ASA / FTD (WebVPN) | Memory disclosure on the WebVPN interface leaks session and credential fragments that feed valid account material for the VPN. | Listed | cisco-sa-asaftd-info-disclose |
Where a CVSS-first queue sends you the wrong way
Sort those five by base score and you work the Veeam remote code execution flaw first, because a 9.8 sits at the top of any numeric list. That is not wrong, but it buries the two CVEs that actually decide whether your recovery survives. CVE-2023-27532 is scored a notch lower as a credential disclosure and CVE-2020-3259 lower still as an information leak, yet those are the ones that hand SafePay the backup estate and the accounts it rides into the NAS management plane. A score that rates each flaw in isolation cannot see that here the quiet disclosure bug is the pivot and the loud remote code execution bug is merely the entrance. The queue that patches by number alone closes the front door while leaving the key to the vault on the mat.
How TRIS scores these findings
TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, scores a finding across the layers that decide whether a CVE should move your week, rather than by base severity alone. For this set the layers walk like this.
Active exploitation. All five CVEs are in CISA KEV with confirmed in the wild use, and a government advisory ties them to an active, high volume crew. A proven proof of concept is not the same as confirmed abuse, but here the advisory reports observed attacks, so this layer runs hot on any exposed instance.
Blast radius against the asset. TRIS reads what the vulnerable host actually is. A Veeam server or a backup NAS is the recovery plane for everything behind it, so a credential disclosure on that box scores far above the same class of bug on a general purpose server. This is the layer a CVSS base score never captures.
Local exposure. Here the same CVE earns two very different numbers. A Veeam server and a NAS management interface reachable only on a segmented storage network, behind separate credentials and MFA, score well below the identical versions exposed on the general network under a reused domain admin account. TRIS reads the real network position and the roster of accounts that can reach the management plane, so the finding lands in the top band on an exposed instance and a good deal lower on a segmented one.
Patch and recovery posture. TRIS lowers the layer where a fix is applied and raises it where the recovery path shares a credential plane with production, because that is the condition SafePay exploits. Running the real CTEM loop against your inventory is what turns these layers into one instruction per host instead of five severity badges.
What to hunt this week
The intrusion is reversible right up until the recovery kill, so the signal you want is the activity before encryption. Put the backup plane at the center of the hunt.
Watch the NAS and backup management plane. Treat an interactive administrator login to the NAS or Veeam console from a new source host, or from a domain admin account that does not normally touch storage, as an incident until proven otherwise. Alert on appliance configuration reset, volume delete, and factory default events in the NAS audit log, and ship those logs off the device so a reset cannot erase its own evidence.
Watch the host recovery kill. Alert on shadow copy deletion, on a stop of the Volume Shadow Copy Service, and on boot configuration changes that disable Windows recovery. On a server these rarely have a benign explanation and they cluster in the minutes before encryption.
Watch for defender tampering and staging. A sudden Set-MpPreference call that disables real time and behavior monitoring, a new whole drive exclusion, or tamper protection changes are the pre staging tell. Flag execution of share enumeration tooling such as ShareFinder and SharpShares, large split archives written to temporary directories by WinRAR or 7-Zip, and outbound rclone or bulk uploads from servers that do not normally talk to the internet.
Watch the front door. SafePay's entry is valid accounts where MFA was missing, often routed through commercial anonymizer exits such as Mullvad. Alert on VPN logins from those ranges and on first time RDP from new source networks, and treat any of the five CVEs above as a compromise hunt, not only a patch, if the asset was exposed before you fixed it.
Remediation
Patch the five initial access CVEs now and hunt on anything that was exposed, because SafePay keeps valid accounts after the hole closes. Fixed and current builds of Veeam Backup & Replication close CVE-2024-40711 and CVE-2023-27532, a current SonicOS build closes CVE-2024-40766, and patched Cisco ASA and FTD software closes CVE-2023-20269 and CVE-2020-3259. Make MFA mandatory on every VPN and RDP path with no exceptions.
Then protect the recovery path as if it is the primary target, because for this actor it is. Keep at least one immutable or offline backup copy that no domain or NAS administrator account can delete or reset, so a stolen admin identity cannot reach it. Put the NAS and backup server management interfaces on their own segment, require separate credentials and MFA to administer them, and alert on any reset or wipe operation. Rotate the Veeam configuration database secrets and every account that touched an exposed backup or VPN appliance during the window.
How CVEasy AI surfaces this
CVEasy AI, the number one local-first CTEM platform, ingests the raw sources an on-call analyst actually reads, the CISA advisory, the KEV listing, and the vendor PSIRT feeds, and runs them through TRIS against your inventory on your own hardware, so the morning view shows which of your Veeam servers and backup appliances are reachable and under reused credentials rather than a row of severity badges. BASzy, our attack simulation engine, replays this actor's kill chain in authorized engagements, so you learn whether your NAS survives a factory reset from a stolen admin account before SafePay finds out for you.
Sources: CISA AA26-293A, CISA KEV catalog, The Record, Cyble SafePay profile, Veeam KB4649, Cisco PSIRT