The IT Nerd

The SafePay ransomware group has compromised at least 600 organizations across multiple critical infrastructure sectors since August 2024, according to a new joint advisory from CISA, the FBI and international law enforcement agencies. Victims span North America, South America, Europe and Australia.

The advisory identifies SafePay as one of the most active ransomware groups in 2026.

Attackers gain access through stolen credentials, brute-force attacks, compromised VPN accounts and vulnerabilities in internet-facing devices, including firewalls.

Once inside networks, SafePay operators steal sensitive data, disable security protections and encrypt systems. Researchers also observed attackers deleting backup copies and resetting network-attached storage devices to disrupt recovery. The group threatens to publish stolen information if victims refuse to pay.

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“SafePay hit at least 600 organizations without a single zero-day. The joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) lists five vulnerabilities used for initial access, the newest published in September 2024, the oldest patched more than six years ago. Six hundred critical infrastructure organizations had years of free scanner coverage and Known Exploited Vulnerabilities catalog entries for every one of these flaws, and still never got the window to apply them.

“The advisory’s own details show attackers know exactly which systems nobody wants to touch. Two of the five vulnerabilities target Veeam Backup & Replication, and SafePay pairs them with halting the Volume Shadow Copy Service and resetting network-attached storage to factory settings. A firewall reboot might break the plant floor. A backup server restart might void the recovery plan. So the boxes stay running for years on software with public exploit code, because an outage has a name attached to it and an unpatched vulnerability does not.

“That is a scheduling failure, and CISA’s mitigation list treats it as a homework assignment. Until critical infrastructure operators get a funded maintenance window and someone senior who owns the reboot decision, the next SafePay is already inside the perimeter everyone was too afraid to bounce.”

ㅤ

John Strand, Owner, Black Hills Information Security:

“This particular attack is interesting for two pretty mundane reasons. First, they’re going after municipalities and critical infrastructure because, as we keep finding out, these organizations will pay. Look at how many people are affected when services go down. Add the political pressure to get those services restored, and attackers see a good chance of getting paid.

“Second, these are motherhood and apple pie exploitation techniques. We’re talking about advanced AI and exploits being developed incredibly quickly, while a huge number of organizations are still getting hit because of weak passwords and a lack of multifactor authentication.

“That’s what scares me more than the super elite hacks. It’s the standard stuff we still haven’t gotten under control as an industry.”

ㅤ

Josh Marpet, Senior Product Security Consultant, Finite State:

“It should come as no surprise that ransomware is a problem. After all thousands and tens of thousands of organizations have fallen victim to social engineering attacks, technical attacks, and business logic attacks. Wherever these ransomware groups can gain a foothold, they will use it to steal your current data, destroy your backups, and encrypt everything they can get their hot little hands on.

“And at the same time cyber insurance costs, if you include ransomware, are still incredibly high.

“So this group is using exploits that have been around since 2020. Let’s be clear on this, these are some six year old exploits. Oh wait, I’m sorry some of them are from 2024 only two years old.

“What happened to keeping on top of patching? Well, we have so much more software than we ever had before. How do we keep track of it all?

“We engage specialists. Software is built out of Legos. Libraries and functions. If we have a software bill of materials (SBOM), we can easily keep track of what’s there at what version, and if there’s any updates.

“Then updating it just becomes a matter of going down the list. But if you don’t have a software bill of materials, it’s much harder to keep track of a chaotic ever fluid morass.

“It’s 10pm, do you know what software you’re running?”

The fact is that everything needs be on the table. If it’s not, it will get pwned. It is that simple.

Political appointees at the Department of Homeland Security asked CISA to secretly acquire and hack a voting machine, according to a new ProPublica investigation. The findings were intended for the White House, and CISA staff were reportedly instructed not to notify the manufacturer of any vulnerabilities discovered.

Citing two former administration officials, ProPublica reported that CISA employees resisted the request, which was ultimately abandoned.

State election officials reported losing federal cybersecurity assistance, including threat intelligence, vulnerability assessments and network monitoring support, ahead of the November midterms.

CISA released its 2026 election security plan on September 24, although several officials said it arrived too late for much of their election preparation. The White House defended its election security record.

Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:

“From an offensive security perspective, examining voting machines for vulnerabilities is not inherently unusual. Independent security testing is an important part of protecting critical infrastructure. The concern raised by this reporting is not the testing itself, but the reported lack of transparency and the instruction to withhold potential findings from the manufacturer.

“There is a fundamental difference between discovering a vulnerability and reducing the risk it represents. Even when technical evidence is overwhelming, economic tradeoffs, operational pressures, and institutional biases can influence how organizations interpret findings and prioritize remediation. Those realities do not disappear simply because the evidence is compelling.

“One way to navigate these challenges is through a complete security lifecycle: discover the weakness, validate it with evidence, assess its impact, remediate it, and independently verify that the fix works. I often think of this as moving beyond finding vulnerabilities to finding proof and fixing the underlying risk.

“The broader concern is the reported reduction in information sharing and security coordination. Election security depends on more than voting machines. It requires continuous assessment, threat intelligence, monitoring, and cooperation across multiple organizations. Cybersecurity is not simply about proving something can be hacked. Given enough time and resources, that is often the easy part. The real challenge is ensuring that evidence leads to informed decisions, measurable improvements, and demonstrable risk reduction. Otherwise, we’re just getting better at documenting problems we haven’t solved.”

ㅤ

John Strand, Owner, Black Hills Information Security:

“Government agencies identifying vulnerabilities and conducting vulnerability research is fairly normal. That happens. What makes this strange is that, apparently, there was a specific request from the White House.

“I don’t know what the context was or why that request was made, but it does look weird. A White House request for this particular research is unusual enough to raise questions.

“This is one of those stories we need to watch as more information comes out. Government vulnerability research itself isn’t surprising. The circumstances around this request are definitely peculiar. Curiouser and curiouser.”

ㅤ

Josh Marpet, Senior Product Security Consultant, Finite State:

“Security Testing of voting machines is an important aspect of the security around the entire election process. Done properly, it’s openly reported on, in collaboration with the manufacturer, in order to improve the security of the voting process.

“As the minority inspector of voting for my district, I am intimately acquainted with the security around the voting machines. I remain incredibly impressed with how well the process protects against any irregularities. Dual control of the electronic record, the paper tabulator record, and the actual paper ballots themselves, is maintained all the way through the process. Every document is cross-referenced to other documents with unique id’s, at all times. In order to taint that process, you’d either have to falsify an identity, which gains you at most, 1 vote, or subvert multiple people in the voting process, which, since there are people from all parties working together, and poll inspectors watching at most to all times, nearly impossible to perform. When it gets up to the county collection point, it’s out of my hands, but others with my background have studied it at that point, such as my friends, Harri Hursti or Matt Blaze. They have explained it with terms similar to mine. Dual control, oversight, and paper records retained for forensic accounting of votes.ㅤ

“Kudos to the CISA employees who resisted the request.”

ㅤ

Jeremiah Fowler, Researcher, Black Hills Information Security:

“There are few things more decisive than politics, elections, and the security of voting machines. If researchers or government agencies were to discover a vulnerability and intentionally withhold that information from the manufacturer or election officials, the potential security risks would remain unresolved and leave those machines vulnerable. Election security should be focused on protecting the integrity of the voting process, regardless of political party. Federal cybersecurity assistance is vital as not all states and localities have the same budgets or resources to protect their election systems. Any disruptions to threat intelligence sharing, vulnerability assessments, and network monitoring are deeply concerning. Unfortunately, we usually do not realize the value of investing in cybersecurity until after a critical incident.

“Simply hacking a voting machine is not as easy as it sounds and many voting systems are designed to operate offline. The real potential risk in my view is in the broader election infrastructure that could include interconnected devices, election management systems, and reporting hardware that could have internet access. In the 2020 election independent election security researchers identified more than 35 voting systems connected to the internet across 11 states and Washington, D.C. The investigation also reported that a main supplier of voting equipment and election-management technology acknowledged that approximately 14,000 voting tabulators were equipped with online modems and had been in use nationwide. It was proof that some election equipment had network connectivity despite assurances to the public that voting systems were disconnected from the internet. All we can do is hope those systems have been updated or replaced.”

Kudos to the CISA for rejecting this request. But having said that, I have so many problems with the fact that someone wanted an election machine hacked is a huge problem. This really should ring alarm bells about the status of democracy in America.