The October 20 joint SafePay warning from CISA, the FBI, the U.S. Secret Service and international partners describes a campaign affecting at least 600 organizations since August 2024. That is a cumulative historical figure, not 600 attacks on the disclosure date.

What the official bulletin establishes

The agencies describe credential exposure, password attacks, phishing and exploitation of internet-facing systems as access routes. They also report interference with recovery, including deletion of shadow copies and resets of network-attached backup storage. SafePay combines data theft and encryption with publication threats; some victims receive direct phone contact.

There is no single affected software version to patch across this campaign. The bulletin prioritizes edge-device updates, known-exploited vulnerabilities, stronger identity controls and restricted administrative privileges. Its discussion of VPN infrastructure should not be read as proof that every connection from a shared VPN address is hostile.

Bulwark assessment: test recovery independence

For a small business or government contractor, the important operational question is whether one compromised administrative identity can disable production and its recovery path. A backup dashboard showing successful jobs answers a different question from whether a responder can restore without the damaged network.

  • Map shared authority. Identify which accounts can administer endpoints, directory services, hypervisors and backup storage. Review whether backup deletion and retention changes require genuinely separate authority.
  • Run an isolated restore exercise. Choose a critical business service, establish a trusted recovery environment and restore a representative dataset. Measure elapsed recovery time and verify application function, not just file availability.
  • Preserve evidence outside the target. Forward relevant identity, perimeter and backup-administration logs to a destination with separate access controls. Investigate sequences such as a new privileged session followed by retention changes; an isolated event is not attribution.
  • Plan for stolen data as well as downtime. Maintain an incident contact list and decision authority outside ordinary company systems. Preserve suspicious communications and route extortion decisions through the designated incident lead. A successful restore does not resolve possible data exposure.

Evidence limits and sources

This report uses the accessible official announcement. The linked full advisory was unavailable during review, so no unreviewed indicators, detection rules or specific CVE list are reproduced here. The priorities above are Bulwark’s operational analysis, not claims about activity inside any particular reader’s network.