A joint advisory from CISA, the FBI and partners says SafePay ransomware has hit more than 600 victims, and the way in is often painfully ordinary. According to the warning, the group uses SafePay ransomware stolen VPN credentials to simply log in, and it also exploits two 2024 flaws in Veeam and SonicWall gear. The takeaway is simple: a VPN gateway is only as secure as its logins and its firmware.

What the SafePay advisory says

The advisory, issued by CISA, the FBI and partner agencies, reports that SafePay ransomware has compromised 600+ victims. Two initial access routes stand out: valid VPN credentials that attackers obtained elsewhere, and two vulnerabilities from 2024 affecting Veeam and SonicWall products.

The source material is brief, so some details are not covered here, such as the specific CVE identifiers or the full list of affected sectors. Administrators should read the original advisory directly for the technical indicators and mitigation list. What the summary does make clear is the pattern: attackers are not relying on exotic techniques. They are using access that was either leaked or left unpatched.

How stolen VPN logins and edge flaws open the door

A VPN is meant to be a controlled entrance to a private network. If an attacker holds a valid username and password, that entrance opens for them just as it does for an employee. To the VPN, a stolen login looks like a legitimate session, which is why this route can be hard to spot without extra checks.

Stolen credentials tend to come from earlier breaches, phishing, or password reuse across services. If a staff member uses the same password for a work VPN and a personal account that later leaks, the attacker needs no technical exploit at all.

The second route is unpatched edge devices. Firewalls, VPN appliances and backup software sit at the boundary or at the heart of a network, so a flaw in them can give attackers a strong foothold. The advisory points to two flaws from 2024, one in Veeam and one in SonicWall gear. The fact that 2024 vulnerabilities are still being used matters: it suggests that fixes exist but are not always applied.

Together, these routes show why perimeter tools need the same attention as any other critical system. A VPN protects traffic only if access to it is protected, and the appliance itself must be kept current.

Steps to harden VPN access and edge devices

None of the following is exotic, and most of it aligns with the weaknesses the advisory describes.

  • Require multi-factor authentication on every VPN login. A stolen password alone should not be enough to get in.
  • Patch SonicWall and Veeam products promptly. Check that the 2024 fixes have actually been installed, not just scheduled.
  • Watch for credential reuse. Compare employee credentials against known breach data and force resets where exposure is found.
  • Review VPN logs for unusual activity. Logins at odd hours, from unexpected locations, or from accounts that are normally idle deserve a closer look.
  • Remove stale accounts. Former employees and unused contractor logins are easy targets.
  • Protect backups. Veeam is backup software, so a compromise there can undermine recovery. Keep copies isolated and test restores.

What the 600-victim tally means for organizations and users

For organizations, 600+ victims is a reminder that ransomware groups scale by repeating what works. If a single weak login or an old unpatched appliance is enough, then basic hygiene is one of the most effective defenses available, and one of the cheapest.

For individual users, including people who connect to a work VPN or use a consumer VPN service, the lesson is about credentials. Use a unique password for every account, turn on multi-factor authentication wherever it is offered, and change passwords promptly if a service you use reports a breach. Employees are part of the defense, since their logins are exactly what attackers are after.

It also helps to remember what happens after a network is breached. Ransomware operators often add pressure through extortion demands and threats to expose data. The ATB extortion story, in which a group calling itself DataSuckers reportedly demanded $400K with 7.9M people said to be affected, shows how that pressure plays out once attackers have gained access.

What This Means For You

If you manage IT systems, treat your VPN gateway and backup software as high-priority assets. Audit who can log in, confirm multi-factor authentication is enforced, and verify that SonicWall and Veeam updates are in place. If you are an everyday user, secure your own accounts: unique passwords, MFA, and quick action after any breach notice.

Key takeaways

The SafePay ransomware stolen VPN credentials warning is a call to fix fundamentals. Enforce MFA on all VPN logins, patch SonicWall and Veeam devices without delay, and monitor for reused or leaked credentials. Attackers who can simply log in do not need to break in, so make logging in much harder for them.