Six agencies map a ransomware group that wipes the backups before asking for money.

Six law enforcement and cybersecurity agencies in the United States, Germany and the United Kingdom have jointly published how one ransomware group operates, drawing on investigations that run as recently as August this year. The group has reached at least 600 organisations since August 2024, with victims in Europe, Australia, North America and South America, and across several critical infrastructure sectors.

The agencies addressed the document to operational technology owners and operators as well as to security teams: the people who answer for the systems that keep a mill turning and a substation reporting. Nothing in the method is exotic. The group gets in through remote access and internet-facing equipment left unpatched, takes over or creates administrator accounts, then works the network with the tools already installed on it.

What makes it expensive is the order of operations. Before anything is encrypted, the group stops the Windows service that keeps point-in-time copies of files, and returns the storage appliance holding the backups to factory condition. Only then does the encryption run, and the demand that follows is typically pegged to a share of the victim's revenue, paid in cryptocurrency. The audience for this one is whoever owns the backup and whoever owns the perimeter firewall, and in a lot of operations those are two different contractors.

Where this lands on a plant

A group that never touches a controller can still stop production. The file shares it hunts for are where the drawings, the configuration backups and the maintenance records live, and the enumeration tools listed in the advisory exist to find exactly those shares. Lose that set and the plant does not stop the way a tripped breaker stops it. Work orders cannot be raised, a vendor cannot be told which firmware a panel is carrying, and the engineer who could rebuild a configuration from memory is one person who may be on leave.

Then there is the account problem. In some incidents the group changed the passwords of system users, so legitimate logins stopped working while it was still inside. That is a control room losing its own tooling at the moment it most needs it, and it turns a server-room incident into a supervisor working the phone.

The recovery path is the part worth dwelling on. Stopping the shadow copy service removes the quick local restore, and factory-resetting the backup appliance removes the slow one. In some cases every network-attached backup of company data was deleted. An operation that can restore from media held off the network loses hours. An operation whose only copy sat on a share reachable from the same domain loses the copy.

The access tools the group leaves behind are the same class of product an integrator uses legitimately: remote desktop software pushed onto victim systems to carry the ransomware, and a remote support package kept for persistence. On plant where a panel vendor dials in once a quarter, one more remote access agent is not obviously out of place.

Commercially, the demand is scaled to the business rather than to the data. A share of revenue, in cryptocurrency, negotiated through a chat portal on an anonymity network with a victim identifier for a login, with a phone call to apply pressure and a leak site if the answer is no.

The questions this puts to the people who hold the record

The agencies put patching of firewalls and other edge devices at the head of their recommended actions, and single out multifactor authentication, the second login step, for remote access and for accounts that reach critical systems. That turns into a small number of questions with names attached to them.

The question for whoever holds the patch register is whether the firewall and the remote access concentrator at each site are on it at all. Every vulnerability the agencies list is a previously known one. Nothing here required the group to find something nobody had seen.

For the backup owner, the question is whether the appliance holding plant backups can be reached, and reset, by anything holding domain administrator rights, and when a restore of a control system from it was last proven rather than reported. For the maintenance record, it is which remote access agents are installed on plant systems today, who authorised each one, and whether a new one appearing would raise anything with anybody.

And the question for the board is better asked before the night it matters: who decides on payment. The agencies state plainly that they do not encourage it, and that paying does not guarantee the files come back.

This advisory does not ask an operator to chase a new defect. It describes a group that needs an unexamined box at the perimeter, an account it can promote, and a backup it can reach. Two of those are decisions somebody already made. The third is often a cable, and the document showing when the plant backup was last restored and proven is worth finding while it is still a filing question.

The technical record

The joint advisory carries alert code AA26-293A, released 20 October 2026 as the initial version. Its authors are the FBI, CISA and the United States Secret Service; in the United Kingdom, the National Crime Agency and the North West Regional Organised Crime Unit; and in Germany, the Landeskriminalamt Rheinland-Pfalz.

Five previously known vulnerabilities are listed. CVE-2020-3259 (CWE-200) and CVE-2023-20269 (CWE-288) are described as exploited on edge device products, reached using phished account profiles and addresses belonging to the Mullvad VPN service. CVE-2023-27532 (CWE-306), CVE-2024-40711 (CWE-502) and CVE-2024-40766 (CWE-284) are described as exploited across internet-exposed systems by automated scripts.

Post-access tooling: PsExec, Windows Remote Management and Remote Desktop Protocol for remote execution and lateral movement; ShareFinder.ps1 and SharpShares.exe for share enumeration; Mimikatz for credential theft; NetExec for enumeration and credential validation. Privilege escalation by User Account Control bypass (T1548.002) and token impersonation (T1134.001); software packing to conceal code (T1027.002); security tooling disabled (T1685); recovery inhibited (T1490); the ransomware deleted from the filesystem after encryption (T1070.004). Collection and exfiltration: 7-Zip, WinRAR, RClone and FileZilla for staging, WinSCP and RClone for transfer, OneDrive in some instances, and b2.exe for upload to Backblaze B2 storage. Delivery and persistence via AnyDesk, TeamViewer and ScreenConnect.

Encryption is hybrid: a ChaCha20 stream cipher with RSA for key exchange, applied in full or in part according to file type and size, with the .SafePay extension appended. The advisory states that data encrypted by this variant cannot be recovered without the decryption key.

Indicators are published as STIX XML and JSON packages and cover activity observed between November 2024 and August 2026. The agencies ask that addresses be checked against current telemetry before any blocking decision, because infrastructure of this kind gets reassigned and an address that was hostile then may be serving something ordinary now. Activity is mapped to the MITRE ATT&CK matrix for enterprise, framework version 20.

On remediation, the advisory directs organisations to prioritise known exploited vulnerabilities on internet-facing systems and points to Binding Operational Directive 26-04 for a patch prioritisation framework and forensic triage steps. It closes with the usual segmentation, backup and least-privilege guidance.