A joint advisory published October 20 by the FBI, CISA and U.S., German and British partners reports at least 600 SafePay victims across multiple critical infrastructure sectors. The agencies describe activity since August 2024 and investigative findings through August 2026.
The report describes stolen or guessed credentials and exploitation of exposed systems as entry routes. Attackers then use administrative accounts and legitimate remote-management tools to move through networks. The agencies also observed interference with recovery, including factory resets of network-attached storage holding backup data. They recommend patching edge systems, restricting administrative privileges and strengthening account protection.
NAOAT analysis
For an operations team, the connection between production access and backup administration deserves particular attention. A copy of a file provides little reassurance if the same compromised account can erase both the working data and the recovery copy. A useful review therefore follows permissions across systems, rather than treating the backup product as a separate checkbox.
Legitimate software also makes interpretation important. The presence of a remote-access or file-transfer application alone does not establish an intrusion. A review should connect the tool to the account using it, the destination, the timing and the approved maintenance activity. That context helps distinguish an administrator doing routine work from an unexpected sequence of actions.
A practical tabletop exercise could ask what remains available after administrative credentials are lost: who can isolate affected equipment, where recovery instructions are stored, and which restore paths have actually been tested. The advisory gives teams a concrete threat scenario for that discussion. Its victim count describes observed harm; it does not measure the probability that a particular company will be attacked.