CISA stopped reliably sending KEV alerts.
We didn't.
CyberComply monitors the CISA Known Exploited Vulnerabilities catalog 24/7 and alerts you the moment a new KEV drops — before the deadline clock starts ticking without you knowing.
KEV Intelligence Brief: Special Edition — AA26-293A (SafePay)
Audience: Federal Contractors · DevOps & Platform Teams · Security Operations Leaders Classification: TLP:CLEAR Reporting Period: October 20, 2026
The FBI, CISA, the U.S. Secret Service, and partners in Germany and the UK released a joint #StopRansomware advisory today on SafePay, a group that has hit at least 600 victims across multiple critical infrastructure sectors since August 2024 and ranks among the most active ransomware operations of 2026. The advisory names five CVEs. CISA added none of them to KEV today, because all five were already there. The newest is from 2024. For the second time this month, a joint advisory shows the same lesson: attackers are succeeding on vulnerabilities defenders already had deadlines for.
How SafePay Gets In: Old CVEs Plus Stolen Logins
The advisory describes two access paths, and the distinction matters for how you defend.
Phished credentials against Cisco VPNs. SafePay operators connect from Mullvad VPN IP addresses and use phished account profiles to exploit two Cisco ASA and Firepower Threat Defense flaws:
- CVE-2020-3259: an information disclosure in the web services interface that can leak memory contents, including credentials and session data.
- CVE-2023-20269: an authentication bypass in the remote access VPN feature that enables brute-forcing of VPN logins.
This is not blind exploitation. The attacker arrives with a stolen username and password and uses the vulnerability to get past what should have stopped them. Patching closes the bug, but an organization with unpatched ASA appliances and no MFA on remote access is exposed on both fronts at once.
Automated scanning of internet-exposed systems. Separately, SafePay runs scripts that hit three more flaws:
- CVE-2023-27532 (Veeam Backup & Replication): missing authentication on a critical function, which lets an unauthenticated attacker pull credentials stored in the backup configuration database.
- CVE-2024-40711 (Veeam Backup & Replication): deserialization of untrusted data leading to remote code execution.
- CVE-2024-40766 (SonicWall SonicOS): improper access control in management and SSL VPN access.
Operational guidance: Inventory every Cisco ASA/FTD, SonicWall, and Veeam Backup & Replication instance, internet-facing ones first, and confirm each is on a build that fixes these CVEs. Enforce MFA on every remote access path, including legacy VPN profiles and local accounts that may bypass your identity provider. Alert on VPN authentication from Mullvad and other commercial VPN ranges, and treat a burst of failed VPN logins followed by a success as an incident, not noise. For SonicWall, also reset local SSL VPN account passwords, since credentials may have been harvested before the patch.
The Backup Problem, at Veeam Scale
Two of the five CVEs are in Veeam Backup & Replication, and that is not incidental. One exposes stored credentials; the other gives code execution. Together they give an attacker both the keys to your environment and control of the system you would use to recover from it.
The advisory confirms where this leads. Before encrypting, SafePay halts the Volume Shadow Copy Service and resets network-attached storage devices holding backup data to factory settings. The goal is not just to lock your files. It is to make sure you have nothing to restore from.
Readers of last week's briefs will recognize the pattern from the AhsayCBS chain. The difference is reach: Veeam is far more widely deployed, which makes this the bigger exposure for most organizations.
Operational guidance: Treat backup servers as tier-zero assets, on par with domain controllers. Remove Veeam management interfaces from internet exposure entirely, and segment backup infrastructure from the production domain so a domain admin compromise does not hand over the backups too. Keep at least one copy immutable or offline, where a factory reset of a NAS cannot touch it, and test restores from that copy. If a Veeam server ran a vulnerable build while reachable from untrusted networks, assume its stored credentials are exposed and rotate them.
After the Breach: What to Hunt For
SafePay leans on legitimate tools, which makes detection a matter of context rather than signatures.
- Lateral movement and execution through PsExec, WinRM, RDP, and remote monitoring and management software
- Share enumeration with
ShareFinder.ps1andSharpShares.exeto locate valuable files - New or modified admin accounts, and in some cases changed user passwords that lock legitimate users out
- UAC bypass through elevated COM objects, and token impersonation
- Security tooling disabled ahead of lateral movement
- Staging and exfiltration with 7-Zip, WinRAR, FileZilla, WinSCP, RClone, and OneDrive, with AnyDesk or TeamViewer installed to move payloads
- Recovery sabotage: Volume Shadow Copy Service stopped, NAS backup devices reset
- Encryption with a
.SafePayextension, followed in some cases by the binary deleting itself
SafePay also runs double extortion with a twist: a representative calls victims by phone to push for payment, and unpaid victims' data goes to a leak site.
Operational guidance: Restrict PsExec, WinRM, and RMM tools to named administrators and alert on use outside that group. Flag any RClone or WinSCP execution on servers, and any new AnyDesk or TeamViewer installation that did not come through IT. Load the advisory's STIX indicator files into your SIEM. Prepare staff for the phone call: anyone who might answer it should know to route it to incident response, not negotiate.
Summary Deadline Status
| CVE | Vendor / Product | Access Path | KEV Status | |---|---|---|---| | CVE-2020-3259 | Cisco ASA / FTD | Phished credentials + VPN | Overdue | | CVE-2023-20269 | Cisco ASA / FTD | Phished credentials + VPN | Overdue | | CVE-2023-27532 | Veeam Backup & Replication | Automated scanning | Overdue | | CVE-2024-40711 | Veeam Backup & Replication | Automated scanning | Overdue | | CVE-2024-40766 | SonicWall SonicOS | Automated scanning | Overdue |
All five have been in the KEV catalog since 2023 or 2024, so every BOD 26-04 deadline here passed long ago. An affected federal or contractor asset is not a late patch; it is a long-standing compliance finding that should be escalated and treated as a candidate for compromise assessment, given how many organizations SafePay has already reached through exactly these doors.
Sources: CISA Advisory AA26-293A: #StopRansomware: SafePay Ransomware · CISA KEV Catalog · StopRansomware.gov · Cisco Security Advisories · Veeam KB4424: CVE-2023-27532 · Veeam KB4649: CVE-2024-40711 · SonicWall SNWLID-2024-0015: CVE-2024-40766 · CISA Edge Device Security
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — October 20, 2026
AI-Driven Attack Campaign Expands from South Korea to Japan and Global Targets
The ARTEX-based campaign previously reported against South Korean financial institutions has expanded significantly, with Bloomberg confirming the same Chinese-developed AI tool was used to breach major Japanese companies including GMO Internet Group. Separately, Reuters documented a Chinese-speaking threat actor who used autonomous AI agents—specifically DeepSeek and Claude Code—to compromise over 100 companies globally, including John Deere and SharkNinja, at an average cost of $50 per breach. The actor conducted more than 1,200 automated break-in attempts with minimal human involvement, assigning reconnaissance and exploitation tasks directly to AI models. This represents confirmation of operational AI agent deployment across multiple concurrent campaigns, with the low cost-per-breach and minimal operator involvement demonstrating a fundamental shift in attack economics. Ransomware operators are now using generative AI to accelerate reconnaissance phases and prioritize high-value data for theft and disclosure, according to separate reporting on ransomware tactical evolution.
Palo Alto Networks Firewall Vulnerability Under Active Ransomware Exploitation
Unit 42 confirmed active exploitation of PAN-OS authentication bypass vulnerability CVE-2026-0257 by ransomware groups Spikey Scorpius (Qilin) and Tarnished Scorpius. The vulnerability allows unauthenticated attackers to bypass authentication on affected firewall management interfaces. Unit 42's October 19 update to its threat brief indicates ongoing exploitation targeting enterprise perimeter defenses, though specific victim counts and attack timelines were not disclosed. The exploitation follows established ransomware operational patterns of weaponizing firewall and VPN vulnerabilities for initial access to corporate networks.
Critical Infrastructure and Application Security Incidents
Check Point Research disclosed two critical vulnerabilities in the LiteLLM AI gateway—CVE-2026-35029 and CVE-2026-59823—that enable administrative takeover or remote code execution. An anonymous hacker group claims access to 375,000 State Bank of India customer records in an unconfirmed data breach. Recruitment platform Bullhorn is responding to a cyber incident affecting operations in Australia, the UK, and the US, warning customers of targeted social engineering attacks during the breach response. NSO Group avoided contempt proceedings despite WhatsApp allegations of continued exploitation activity, according to October 19 court filings.
Sources: Bloomberg · Chosun · GBHackers · GBHackers · Unit42 · Check Point Research · Cybersecurity Connect · Law360
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
Attackers used a compromised contributor's GitHub account to replace OVHcloud CLI downloads with malicious builds designed to steal secrets from affec...
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Unknown threat actors abused a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup to gain unauthorized access to 173 customers...
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
#1 Trusted Cybersecurity News Platform. Followed by 5.70+ million · The Hacker News Logo... Get the Latest News. Home; Newsletter ...
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026, weeks before...
FBI Director Announces Arrest of Suspected ShinyHunters Co-Conspirator After FBI Jobs Portal Breach
FBI Director Kash Patel announced the arrest of a suspected ShinyHunters hacking group co-conspirator linked to the data breach of the FBI's jobs port...
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Chinese APT Armory Castle exploited BeyondTrust CVE-2026-102764 as a zero-day since August, deploying custom tools and deleting logs to cover tracks.
Prolific Chinese espionage group exploits BeyondTrust zero-day
Chinese APT Armory Castle exploited a critical BeyondTrust vulnerability (CVE-2026-102764) as a zero-day since August, targeting customers with advanc...
China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign
... Cybersecurity Dive. The Cybersecurity and Infrastructure Security Agency added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog ...
Updated daily