Last week, CISA, the FBI, the U.S. Secret Service and international partners published a joint advisory about a ransomware group called SafePay. According to the advisory, the group has been active since August 2024, was among the most active ransomware groups in 2026, and has affected at least 600 victims across North America, South America, Europe and Australia.
The advisory is written for network defenders, but the lessons apply to a five-person office or a small law firm just as much as to a large enterprise. Here is what the agencies describe, in plain language, and what you may want to check this week.
What the advisory says
Based on the advisory, SafePay actors have typically:
- Gotten in through the front door. Stolen, phished or guessed passwords, brute-force login attempts, VPN access, and known vulnerabilities in internet-facing devices such as firewalls and remote-access systems.
- Used normal admin tools once inside. Rather than relying only on obvious malware, they reportedly use built-in Windows features and legitimate remote-access and file-transfer software, which can make activity harder to spot.
- Gone after backups. The advisory says the actors stopped Windows shadow copies and, in some cases, reset network-attached storage holding backups to factory settings or deleted network-attached backups.
- Stolen data, then encrypted it. Victims are pressured with the threat of publishing stolen data on a leak site, and the advisory notes that representatives sometimes phone victims directly.
The agencies state that files encrypted by this ransomware cannot be recovered without the decryption key, and they do not encourage paying a ransom, noting that payment does not guarantee recovery.
Why this matters to small businesses and law firms
Smaller organizations often depend on a single firewall or VPN, a handful of shared admin passwords, and one backup device sitting on the same network as everything else. That is exactly the pattern this advisory describes attackers taking advantage of.
For law firms and other professional offices, the data-theft step may matter as much as the encryption. Client files, privileged communications and financial records can create notification, ethical and reputational questions even if systems are restored from backup.
A practical checklist
These steps reflect the advisory's recommended mitigations, translated for a smaller office. Not every item will fit every environment.
- Confirm your firewall, VPN and other internet-facing devices are on current firmware, and check them against CISA's Known Exploited Vulnerabilities catalog.
- Require multifactor authentication on email, VPN and any remote access, especially for admin accounts.
- Look for admin or user accounts nobody recognizes, and remove access that is no longer needed.
- Move away from short, shared passwords toward long, unique ones stored in a password manager; turn on lockouts after repeated failed logins.
- Keep at least one backup copy offline or immutable — not just a device on the same network that an attacker could reach and wipe.
- Actually test a restore. A backup you have never restored is an assumption, not a plan.
- Know which remote-access tools are approved in your office, and treat unfamiliar ones as a red flag.
- Write down who to call — IT, counsel, insurer — before you need to.
If you would like a second set of eyes on these items, our cybersecurity, backup and recovery and managed IT teams work with small businesses on exactly this kind of review.
If something already looks wrong
If you see signs of a possible intrusion — unknown accounts, security software turned off, unexpected remote-access programs, backups that suddenly fail — the advisory's incident response steps begin with identifying and isolating affected systems and collecting logs and other artifacts to understand what happened.
That second part is easy to skip under pressure. Wiping and reimaging machines right away can get you running again, but it can also destroy the evidence that shows how the attacker got in, what they accessed and whether data left the network. Those answers often matter for insurance claims, notification decisions and any later legal matter. Where practical, preserve first, then rebuild. Our article on preserving digital evidence before you reset a device explains why, and our digital forensics work covers examining affected systems.
The agencies also urge victims to report ransomware incidents to the FBI's Internet Crime Complaint Center (IC3), a local FBI or Secret Service field office, or CISA, whether or not a ransom is paid.
Frequently asked questions
We're a small office. Would a group like this really target us? The advisory describes automated scanning and exploitation of internet-exposed systems, which generally does not depend on an organization's size. Exposure, more than size, tends to drive risk.
We have backups. Are we covered? Possibly, but the advisory specifically describes attackers deleting or resetting network-attached backups. An offline or immutable copy that has been test-restored is a much stronger position.
Should we pay if it happens? That is a decision for you, your counsel and your insurer. The agencies do not encourage payment and note it does not guarantee your files will be recovered.
Limits and caveats
This article summarizes a public government advisory as of October 25, 2026. Threat activity changes, and details in the advisory may be updated. The checklist is general guidance, not a complete security program or legal advice, and no set of controls can rule out a breach. For the full technical details, indicators of compromise and mitigations, read the CISA advisory directly.
Talk to us
If you would like help with this checklist, we can run it with you. Executive Digital Group handles cybersecurity, IT services, digital forensics and OSINT, so one team can cover each step:
- Remote access review: we look at your VPN, firewall, remote-access tools and who can log in from where.
- Account and admin audit: we find accounts nobody recognizes, remove access that is no longer needed, and help set up multifactor authentication and stronger passwords.
- Backup setup and testing: we help put in an offline or immutable backup and test a real restore.
- Incident response: if something already looks wrong, we help you isolate systems, preserve the evidence and work out what happened.
Give us a call for a friendly, confidential conversation about where you stand and what makes sense for your office.
- New York: 631-982-4632
- Boca Raton, FL: 561-391-6057
- Hours: Monday–Friday, 9 AM–5 PM ET
- Request a confidential consultation
Executive Digital Group is a women-owned business founded by Tiffany Graziano and her husband, Michael Graziano. We provide digital forensics, OSINT, investigations, cybersecurity and managed IT, with remote support anywhere in the U.S. and worldwide.
Originally published on the Executive Digital Group website on October 26, 2026.