Ransomware Hit 600 Organizations. Here’s What the Gang Does Once It’s Inside.
This week the FBI and CISA, the federal cybersecurity agency, put out a joint warning about a ransomware gang called SafePay. In a little over two years, it has hit at least 600 organizations across the U.S. and Europe. The agencies call it one of the most active ransomware groups of 2026.
Most coverage focuses on the big names. I want to focus on something more useful for a business owner in Tucson or Nogales: what these attackers actually do once they’re inside. Because that’s where you can stop them.
Stage 1: How they get in
There is no movie-style hacking here. According to The Record’s report on the advisory, SafePay gets in by guessing passwords, exploiting known software holes, and phishing. Automated scripts also scan the internet for exposed systems, the same way a burglar tries every door on a street.
The boring doors are the dangerous ones
Weak logins and old, unpatched firewalls or VPNs are the usual way in. If you read our earlier post on patching your router and firewall, this will sound familiar.
Stage 2: How they dig in
Once inside, the gang doesn’t rush. The advisory describes them creating new accounts or taking over existing ones. They use normal admin tools already on your network to look around and find valuable files. Then they switch off your security protections. Sometimes they even change user passwords so you can’t log in.
Why this matters to you
Think of a burglar who copies your keys, turns off the alarm, and then takes his time. Every one of those steps leaves a footprint: a new admin account nobody created, antivirus that suddenly stopped, a remote-access tool like AnyDesk or TeamViewer that nobody installed. The advisory notes those remote tools are used to move the ransomware around. If someone is watching, those footprints are your early warning.
Stage 3: They steal first, then lock
This is the part that surprises people. Before the files are encrypted, the attackers copy them out. Then they lock everything and demand payment in cryptocurrency, and a gang representative may even phone the victim to add pressure. This is called double extortion.
Backups fix the lock, not the leak
Good backups still matter, and they are the reason you can say no to the lock. But if your customer lists, payroll files, or contracts were copied first, restoring from backup doesn’t un-steal them. That’s why stopping the intruder early, before the copying, is the real goal. It’s also why secure, tested data backups and endpoint protection that someone is actually monitoring work best as a pair.
One more reality check: the group reportedly demands a share of the victim’s revenue, and attacks like these have disrupted public services for people who never did anything wrong. It is not only a big-company problem.
What you can do this week
- Turn on multi-factor authentication for email, remote access, and every admin account. Stolen passwords alone should not be enough.
- List who has admin rights. Fewer admins means fewer accounts to hijack. Remove anyone who doesn’t need it.
- Find out who gets alerted when a new admin account is created or antivirus is turned off. If the answer is “nobody,” that’s your gap.
- Check your remote tools. Know which remote-access programs are approved on your computers, and flag any you didn’t install.
- Patch your firewall and VPN and retire anything the manufacturer no longer supports.
- Keep one backup offline or immutable and test a restore. A backup you’ve never restored is a hope, not a plan.
- Train your team on phishing. Short, regular awareness training beats one big annual session.
The bottom line
Ransomware isn’t a single moment. It’s a process that takes place over hours or days, and each stage is a chance to catch it. You don’t need to be a security expert. You need basic locks, someone watching the alarm, and a backup you trust. Our small business cybersecurity solutions are built around exactly that, and a filter like spam and virus filtering closes the phishing door before your staff ever sees it.
Source: The Record, Oct. 20, 2026; Tech Insider on FBI/CISA advisory AA26-293A. More articles on our blog.
Not sure who is watching your alarm?
Book a complimentary visit and we will walk through your logins, admin accounts, backups, and alerts in plain English.
Send us a message
— Nemuel Cruz, Incognito Cyber Security
