SafePay’s joint advisory: when historical indicators justify action today

01

The decision left to a business receiving the warning

On October 20, 2026, the FBI, CISA, the U.S. Secret Service and German and British investigative agencies published joint advisory AA26-293A on SafePay ransomware. It describes operations that steal business information, encrypt files and interfere with recovery. For a business, the next question is which activities to investigate and what evidence should determine the response. [C1]

The advisory lists IP addresses, filenames and hashes observed in connection with attacks. They provide investigative leads, but a business must still connect that history with its own present traffic. Blocking a shared destination wholesale could interrupt legitimate connections with business partners. Dismissing an event because it involves familiar software could overlook an attacker’s use of a legitimate tool. Speed and precision belong in the same response decision. [C1]

That comparison has economic consequences. The scope of a shutdown can affect orders, deliveries, customer service and maintenance by contractors. Delaying necessary isolation and unnecessarily interrupting legitimate work generate costs through different channels. If information has been taken, restarting systems also leaves questions to answer for customers and counterparties. Understanding the different tasks a business must restore is more useful than treating the victim count as a sufficient measure of business impact.

SG Group’s view is that indicators should be connected to the original observation, internal records, authorized activity and a proposed response before they drive operational or purchasing decisions. The worksheet in this article lets a reader classify one record they are authorized to examine. It requires no logs or credentials to be entered on this website. The work takes place in approved internal records, documenting the next evidence question and the intended scope of action.

02

Put the count of 600 alongside three different clocks

CISA’s notice, sent at 3 p.m. EDT on October 20, places at least 600 affected organizations across multiple critical infrastructure sectors within the period since August 2024. The advisory identifies businesses and critical infrastructure in North America, South America, Europe and Australia. The count is neither new victims on a particular day nor victims in 2026 alone. It is not a share of all businesses worldwide or a measure of loss per organization. [C1][C2]

Publication and observation also have different dates. The advisory draws on investigations as recent as August 2026, while the listed indicators were observed between November 2024 and August 2026. August 2024, the starting point of the account of activity, is not the beginning of the indicator window. Publication on October 20 does not establish that the same activity continued at every listed IP address in October. [C1]

Internal records introduce a third clock. An event’s time, the time its record was collected and the analyst’s review time may differ. Matching time zones allows a business to determine whether its event falls inside or outside the original observation window. Overlap alone cannot prove common authorship, but distinguishing the dates avoids a false temporal match. The date of a later search should not be recorded as the date the communication occurred.

Separating the clocks does not diminish the warning. Activity from months earlier may provide a useful lead when compared with records from the same period. Conversely, an explanation that nothing was wrong at an earlier date cannot account for subsequent changes in users or traffic paths. Setting the source window beside internal retention and the period relevant to today’s decision makes the evidence boundary concrete.

03

The same IP address need not identify the same party

The advisory’s closing disclaimer explicitly says that cloud or virtualized infrastructure may use dynamically or temporarily assigned IP addresses. An address previously associated with malicious activity may later be reassigned to a benign service. Listed values represent historical observations and should be corroborated with current network telemetry or additional intelligence before defensive or investigative use. A matching address string alone cannot satisfy that requirement. [C1]

The business question is who used the destination at that time, which internal endpoint or service contacted it, and for what purpose. If a contractor used it for approved maintenance, the event can be compared with the work reference, authorized time and executing account. An approval record does not necessarily explain every connection during that period. The planned task and the observed traffic must refer to the same activity.

Where legitimate connections share an address, a broad block may widen the interruption. Current corroboration that a destination is dedicated malicious infrastructure, combined with suspicious internal behavior, would strengthen the case for action. Neither the reputation of a large service nor the name of a smaller provider settles the issue. Evidence about sharing and the specific communicating party changes the decision.

Turning the IP list directly into an organization-wide blocklist is a different operational choice from acting on corroborated traffic. The latter requires investigation time and a way to manage exposure during that interval. The former carries costs when legitimate connections stop, including decisions about reversal and explanations to counterparties. Neither is costless. The relevant comparison identifies the loss each action is intended to prevent.

04

A legitimate tool’s name is not a verdict on its use

The advisory describes abuse of legitimate compression, file-transfer, remote-support and administration tools, including 7-Zip, FileZilla, RClone, WinSCP, AnyDesk and TeamViewer. It also warns against treating tools as malicious without analytical evidence of threat-actor use or control. Inclusion of a product name is not a breach notification to every customer of that product. [C1]

The executing identity, location, destination and sequence of work provide a better comparison with authorized activity. Even where a transfer tool is approved, an unusual account packaging and sending unrelated material calls for a separate explanation. If the request, records and transferred material match the approved task, a name match alone provides little basis for classifying the whole workflow as malicious.

Filenames present a related problem. The advisory gives examples in which even a legitimate Windows process name becomes suspicious because of context such as its location. A displayed name does not describe all the file’s contents or explain why an operation was authorized. Treating matching names as either automatically safe or automatically dangerous omits evidence. A useful handover states what the name is evidence of, alongside the name itself. [C1]

Keeping legitimate software does not require avoiding investigation. A business can compare permitted scope with actual use and examine unexplained activity. Prohibiting a product entirely may sometimes be appropriate, but that decision also depends on alternatives and management conditions. Reading the advisory as a product safety ranking risks overlooking accounts, permissions and records that remain relevant after the software changes.

Authority to close an investigation after reviewing an alert is a separate question from indicator corroboration: Read about authority to close alerts and reopen investigation.

05

Different indicators answer different evidence questions

An IP address, filename, hash and behavior may appear in the same advisory, but they answer different questions. An IP concerns a location such as a communication destination; a filename concerns a name. A hash is an identifying value calculated from a file’s contents and used to compare it with a known sample. Behavior concerns the relationship between an actor and an operation. A match of one type should not substitute for evidence required by another type.

For example, a record showing a file with the same hash as the source is closer to a content comparison than a matching name. It does not by itself establish execution time, privileges, information sent outside the organization or organization-wide impact. Whether a file was merely stored or actually executed is a separate question requiring other records. Keeping the inference bounded helps identify the next investigative task.

The five vulnerabilities named are CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766. Several identifiers carry earlier years; the advisory describes their use as intrusion paths. It did not announce discovery of five new flaws on October 20. Whether an identifier applies internally depends on the actual product, configuration and manufacturer’s applicability conditions. [C1]

Do not turn technical lists into victim counts

A list of potentially applicable vulnerabilities cannot be added to a list of observed attack indicators to produce a victim count. One device may be associated with several flaws, and one intrusion may use several tools. The advisory also cannot exclude routes that do not use the listed tools. Product and indicator counts are not counts of organizations or successful attacks. Graphing them without a defined unit would create a scale comparison absent from the source.

When reporting to business decision-makers, a statement that something matched should identify what matched: contents, name, destination or behavior, with the relevant time and subject. It can then describe the action supported and the questions left open. That makes the basis of a shutdown or further investigation understandable without transferring every technical detail into a management meeting.

For a separate case distinguishing file identity from provenance and recipient evidence, Distinguish a file match from delivered-software provenance.

06

What remains unanswered when records are missing

If a search finds no matches, its period and coverage matter first. A search of a few weeks of retained data cannot answer a question about all of 2024. Searching a source that did not record the relevant traffic has a similar limitation. These gaps are not evidence of compromise, but they limit the scope of a conclusion that nothing occurred.

The next question is whether the relevant endpoints and contractor activity were included. Central-office records may not represent overseas sites or work under a different contract. That does not imply collecting the same volume of records from every location. Starting with the activity or information in question helps identify the evidence needed. The size of the organization chart is not a substitute for an investigative scope.

For a business with short retention, reducing present exposure may take priority over searching for older indicators. Decisions about a current suspicious connection or unauthorized account may be necessary even when the entire historical record cannot be reconstructed. Requiring a complete historical account before any change could turn an evidentiary caveat into excessive delay. The inaccessible period and the presently actionable subject should be distinguished.

Coverage matters more than volume

More data does not automatically produce a stronger decision. A business may know the time and destination while the authorization record sits in another department. Comparing the event with legitimate work then requires connecting operational and approval records. The task is to preserve references to the original records and the people able to explain them, rather than copying sensitive information into one enormous worksheet.

The source’s IP table distinguishes intrusion, hosting victim data, login panels, exfiltration and command and control. Entries in one list need not correspond to the same traffic or question internally. Before interpreting a connection to an address, examine the role assigned to it in the source. Extracting values without those descriptions discards a useful lead and risks assigning an inappropriate meaning to the traffic found. [C1]

07

Theft, encryption and recovery sabotage create different losses

A central feature of the SafePay account is the overlap between taking information and preventing a business from using it. The advisory describes collection and exfiltration followed by encryption, together with pressure to pay through threatened publication of stolen data. It does not establish identical timing or tools for every victim. An affected business must connect each event with its own evidence. [C1]

Unavailability raises questions about restoring orders, production and data. Exfiltration raises different questions: whose information was held, what was taken and which parties require an explanation. Restoring a backup need not recover copies already sent outside. Uncertainty about theft also does not remove the need to restore unavailable operations safely. Combining the two into one recovery percentage can obscure the remaining work.

The advisory also describes stopping shadow-copy services and resetting network-attached storage containing backups to factory settings. The attack can therefore affect the options for recovery as well as production files. The existence of a repository, survival of its data and an authorized operator’s ability to restore the needed business state are separate questions. Additional device counts alone do not explain that relationship. [C1]

Recovery means also have conditions

Offline backups, protection against alteration or deletion, and restoration testing are recommendations relevant to that sabotage. Merely adopting the name of a storage method does not establish protection of every dataset under every contract. Authorized staff must establish coverage, retention and the authentication and procedures required for restoration. The business needs an explanation of which work can be restored under which conditions, rather than another product list. [C1]

A ransom payment cannot be treated as a contract that resolves both loss paths. The agencies discourage payment and say it does not guarantee file recovery. Even if usable data is restored, the treatment of information already taken and the access used for the intrusion remain separate matters. The count of 600 supplies no basis for calculating future victimization probabilities or recovery times. Management must organize costs around its own interrupted work and information scope. [C1]

For the separate question of standby capacity sharing the same conditions, Compare shared-key recovery and independent standby capacity.

08

Connect urgent containment with preserving evidence

The advisory separates a potential compromise discovered before encryption from one in which encryption has occurred. For the former, it describes identifying and isolating affected hosts, collecting records and artifacts to scope the intrusion, reporting to appropriate agencies and applying eviction countermeasures. For encrypted systems, it points to a separate ransomware and data-extortion response checklist. The evidence and operations requiring urgent protection can differ before and after encryption. [C1]

Evidence collection and eviction are not a simple rule to finish every investigation before acting. The advisory says countermeasures should begin after sufficient hunting data has been collected to inform effective selection, and that the work will probably overlap with hunting. Sufficiency depends on the intrusion and proposed action. The diagram here explains the source’s branches; it does not prescribe commands or a universal waiting period for the reader’s environment. [C1]

A connection to an address described as hosting victim data raises a different question from one described as being used for intrusion. The former does not by itself establish an outbound transfer; traffic direction and content require other evidence. The latter description also cannot establish successful intrusion into this business. Pairing the source role with the internal party, time and corroboration helps responders preserve the correct question. [C1]

Align handovers and outcomes with the same subject

The file table includes License.txt, which can be benign and accompanied a network-scanning tool in one instance. Finding that name does not establish the presence or execution of the same tool package. Staff can ask where it was located, what accompanied it and whether it connects to operations at the relevant time. Individual descriptions should remain beside search results rather than every row inheriting the same malicious meaning from the table heading. [C1]

A tool name also cannot distinguish legitimate cloud storage from theft. The advisory identifies b2.exe as a file-management tool for Backblaze B2 and describes its abuse for exfiltration. Similar internal use raises questions about control of the storage destination and the approved transfer scope. A service-name match does not establish compromise of the provider itself. If legitimate backups use the same service, broad blocking can also affect recovery work. [C1]

09

The business transmission runs through interruption and reconciliation

In cross-border business, an outage can affect work performed by a separate contractual party: sending orders, confirming delivery instructions or accessing material needed for customer replies. These are possible transmission paths, not a claim that every SafePay victim experienced the same delays. Starting with the connections and information needed for critical work connects the advisory’s unavailability and recovery sabotage with relevant cost categories.

Restoration can leave orders and changes accumulated during the interruption to reconcile. If manual processing replaced a normal connection, staff may need to check that completed work is neither duplicated nor omitted when records return. Downtime alone does not measure that task. Transaction types, alternatives and record quality affect the burden, making a generic hourly loss unsuitable as a direct estimate for a particular company.

Possible theft also creates work matching affected material to counterparties. That may follow a different timetable from the return of revenue. Knowing data categories and periods helps focus questions. Overstating or understating scope in an explanation can create further checks and trust costs. Whether notification is required, and by when, depends on applicable law and contracts; the advisory’s general reporting guidance does not establish a universal duty or deadline.

Include the cost of stopping legitimate work

Overbroad indicator-based action can cause another interruption. Blocking legitimate remote support may hold up repair or restoration requests; blocking a valid transfer destination may prevent exchanges with customers or providers. The advisory’s caveats about legitimate tools and historical IPs matter for those consequences. Side effects do not invalidate necessary isolation. They are part of explaining the exposure being reduced alongside the work being stopped.

Loss estimates should also avoid counting the same order twice. A lost order and a delayed shipment or payment have different consequences. Adding the full value of a delayed order to a loss attributed to that same order overstates the burden. Investigation and explanations concerning theft, and rebuilding recovery means, can be separate categories, but the advisory provides no company-level amounts. Multiplying the cumulative lower bound of 600 organizations by an assumed unit cost does not measure actual global losses.

10

Match one internal record to the original evidence

Begin the worksheet with one internal record you are authorized to examine and one specific question—for example, whether an approved task explains a connection to an IP listed in the source. Do not try to decide overall security or the absence of every intrusion in one row. Aligning the record reference, time zone, communicating party and approved task reveals what is missing for that question.

Suppose fictional record A shows a connection after the advisory’s indicator window. Approved maintenance is cited as an explanation, but it has not yet been matched to the connecting account. The row should retain questions about the destination’s user at the time and the identity used for maintenance. Neither an unqualified acceptance of the maintenance explanation nor a verdict of present maliciousness from the historical IP match fills that evidentiary gap.

In fictional record B, a legitimate transfer program is used at a different time or for material outside the scheduled work. Further comparison asks whether an exception was approved, who controlled the executing account and whether records establish what was transferred. Removing the software name does not remove those questions. Decision-makers need evidence connecting the activity at issue with the legitimate work an action would interrupt, alongside any broad product prohibition being considered.

Stronger corroboration and the decision that remains

In fictional record C, a hash matches the known sample and separate records show suspicious execution and operations affecting recovery. The basis for urgency is more concrete than a name or IP match alone. It still does not automatically establish identical conditions on every device. Authorized staff should connect corroborated subjects with the scope being examined for spread. A, B and C are fictional comparisons, not actual victims or detection-performance results.

The final fields pair the proposed action’s target with the work it might interrupt. A device, an account and a shared destination present different decisions. Where legitimate transactions or support could stop, the row should identify who can assess that dependency. Completing the worksheet is not authorization to act; it provides evidence and impact information for the organization’s authorized responders.

Do not fill gaps with assumptions. Record the kind of evidence needed and who holds it. Customer data, traffic logs and secrets should not be sent to this public page. The table is a reading aid for developing questions, not automatic traffic analysis, attribution or a facility for saving entries. Actual completion and sharing belong in approved internal systems under the applicable handling conditions, without unnecessarily copying data outside.

Avoiding unnecessary copies of secrets is also relevant to contracted assessment records: Read about records and secrets retained after an assessment.

11

Does more corroboration simply slow the response?

The strongest objection is that an advancing attack cannot wait for manual checks. Automated detection and isolation can act quickly and consistently. Where dangerous execution is already corroborated, waiting indefinitely because shared IPs can be ambiguous would be unreasonable. The advisory’s caveats are better understood as conditions for designing evidence-to-action rules than as a prohibition on all automated response.

Automation still benefits from distinguishing a single name match from behavior corroborated across several records. Conditions for isolation and further review should fit operational importance and existing response procedures. Speed is not determined only by the number of human approvals. Knowing evidence references and affected work in advance can reduce the effort of rediscovering them during an emergency.

Another objection is that individual indicators have little value when attackers use legitimate tools. Yet indicators can lead investigators to a historical destination or sample when used with the source’s caveats. Their limitations call for a defined evidentiary role, not abandonment. General behavioral monitoring does not necessarily replace a match to a particular historical sample, just as that match cannot explain the entire legitimate workflow.

Connect preparation with the question it answers

The view that backups make the impact small also has conditions. The advisory describes interference with recovery and exfiltration. Demonstrated restoration of necessary work would change the assessment of unavailability, without eliminating the theft question. Strong preparation should receive credit, but evidence of restoration should support conclusions about what it actually restored. [C1]

12

SG Group View: specify what would change the decision

The value of the joint advisory extends beyond knowing an attacker’s name. Moving a historical observation into a present decision requires comparing the party, time and legitimate work behind a matching string. Weak comparison can permit both missed intrusion and excessive interruption. Businesses can therefore assess purchased defensive capability by its connection to appropriate operational action, as well as by tool and indicator counts.

The first kind of decision-changing evidence is concrete corroboration of present malicious activity. Consistent evidence of destination control, suspicious execution, permission changes, exfiltration or recovery sabotage strengthens the case for urgent containment beyond the general possibility of reassignment. Conversely, a coherent account of the identity, subject, timing and records of approved work weakens an inference drawn from a particular match. Both conclusions require actual evidence.

The second is an explanation of the work interrupted and the work that can be restored. If a bounded action stops the activity at issue while preserving necessary support or transactions, the case for broad interruption may weaken. If such targeting is technically unavailable and the threat is concrete, broader isolation may be warranted. Evidence of the conditions under which restoration tests or alternatives worked also improves planning. An assertion that spare capacity exists does not complete that comparison.

Reassess source updates and business implications

The third is a change in the source itself. The advisory is the October 20 initial version, with an explicit indicator window. If a later revision changes its subjects, indicators or observation period, readers should examine the specific amendments even under the same product identifier. A later date should not be taken to revalidate every earlier indicator. New evidence should be linked to the internal decisions it affects; this document provides no date for a future revision. [C1]

Finally, the advisory alone cannot establish aggregate global losses or an investment return from a particular defensive service. It establishes that agencies assembled observations and recommendations about a group active across several regions, with conditions on the use of indicators. The worksheet lets readers examine what one record shows, what evidence is missing and which work an action would affect. That is a concrete step from a victim-count headline to a business decision.