Your Backups Are the Target — Not an Afterthought

Ransomware gangs are patient. They spend days inside a network quietly finding your backups, your recovery tools, your shadow copies — and deleting all of it before they flip the encryption switch. By the time you see the ransom note, your escape hatch is already gone. That is not a hypothetical. It is the documented playbook of a group called SafePay, and the U.S. government just spent a week telling everyone about it.

What Happened This Week

On October 20, 2026, the Federal Bureau of Investigation (FBI), the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom published a joint advisory on SafePay ransomware, warning that the group has been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia.

CISA confirmed that SafePay actors have compromised at least 600 organizations across multiple critical infrastructure sectors, combining data theft and encryption with deliberate attacks on backup systems to obstruct recovery. Six hundred is the confirmed floor, not the ceiling — many small-business victims never report.

The advisory names SafePay among the most active ransomware groups of 2026. That distinction matters because it means the group is not winding down; it is scaling up.

How SafePay Gets In

This is the part that should give every small-business owner pause, because SafePay does not rely on exotic hacking techniques. The group's initial access methods include credential exposure, brute-force password attacks, exploiting virtual private network (VPN) access, and exploiting vulnerabilities in edge device products. In plain English: weak passwords, reused passwords, unpatched routers and firewalls, and phished employee accounts. Standard stuff — which is exactly why it keeps working.

The advisory identifies five exploited vulnerabilities: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. Several of those Common Vulnerabilities and Exposures (CVE) identifiers are years old, meaning organizations that stayed current on patches were protected. Organizations that did not — weren't.

Once inside, the group uses software and services such as PowerShell, Remote Desktop Protocol (RDP), and Windows Remote Management to move through compromised networks — tools that look like normal IT activity, which is why standard antivirus often misses it. Remote access applications, including AnyDesk and TeamViewer, help deliver ransomware and supporting tools. Both are legitimate programs your IT provider may already have installed.

The Move That Changes Everything: Killing the Backups

Here is the tactic that separates SafePay from opportunistic ransomware: it does not encrypt your files first. It goes after your recovery options first.

The operators factory-reset network-attached storage (NAS) devices, deleted all shadow copies, and terminated backup agent processes before encryption, leaving victims with no recovery path. A shadow copy is Windows' built-in ability to roll a file back to an earlier version — a quiet safety net most people never think about until they need it. SafePay thinks about it before you do.

CISA specifically warned that SafePay actors may disrupt recovery operations by deleting shadow copies and resetting network-attached storage devices containing backups. If your only backups sit on a NAS device attached to your local network, you may have just lost them before the encryption even starts.

A Compounding Problem: PHP2Shell

The SafePay advisory did not arrive in a vacuum. Also today, October 21, the PHP development team released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in.

Why does a web-server flaw matter to a small-business owner? PHP powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and a lot of vendor software that does not advertise it. If your website runs on any of those — and most small-business sites do — your web server is running PHP. A proof of concept exploit was released ahead of the official patch, and attackers were already probing sites for exploit opportunities before the fix was available.

Updating WordPress alone or enabling a content delivery network (CDN) or web application firewall (WAF) is not a complete solution. The fix has to happen at the PHP runtime level — meaning your hosting provider or IT person needs to apply it, not just you clicking "Update" inside WordPress.

What This Means for Your Business

Two things happened this week that compound each other. A ransomware group with a proven habit of destroying backups just got a named federal advisory — which means the threat is real, widespread, and not going away. And a critical flaw in the software running most of the internet's websites became public knowledge before a fix even existed, giving attackers a head start.

Neither of these requires a sophisticated attacker to exploit. SafePay uses weak passwords and old, unpatched devices. PHP2Shell required nothing more than sending a malformed web request. The technology barrier is low. The damage ceiling is not.

Businesses that will weather both have three things in common: their software is current, their backups live somewhere SafePay cannot reach (offline or air-gapped, not just a NAS on the same network), and someone is paying attention.

Questions to Ask Your IT Provider — This Week

• Are our backups stored somewhere that cannot be reached or reset if our main network is compromised? A NAS plugged into your office network counts as reachable. A proper offsite or cloud backup with immutable (write-once) storage does not.
• Have the five vulnerabilities listed in CISA advisory AA26-293A been patched on every device we operate? Ask them to confirm in writing, especially for any VPN appliances, firewalls, and Veeam backup servers.
• What version of PHP is our website running, and has it been updated to address PHP2Shell (CVE-2026-109618 and CVE-2026-109619) today? The patched versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
• Do we have multi-factor authentication (MFA) — a second confirmation step beyond a password — enabled on every remote access point, VPN, and email account? SafePay's primary entry is stolen or guessed credentials. MFA neutralizes that entry point almost entirely.
• When did we last actually test restoring from a backup? A backup that has never been tested is a backup you cannot trust under pressure.

SafePay's advisors name the group one of the most active ransomware operations running today. The good news is that every technique it uses has a known countermeasure. The window to apply them is open now, while the cost is low — not after an incident, when it is not.