SafePay Campaign Pressures Critical Infrastructure; 30-Day Exposure Reduction Plan Outlined

A SafePay advisory reports that the threat actors have affected at least 600 organizations since August 2024, typically using valid accounts and exposed remote access. The campaign exploits five named CVEs and may delete or reset backup and recovery systems. The guidance proposes a 30-day plan for operators to build an asset inventory, tier systems by exposure, and patch affected Cisco, Veeam and SonicWall products. It also recommends tightening remote administration accounts, enforcing MFA, segmenting backup management, and testing restores. The plan notes that it cannot remove every risk but can establish a defensible baseline for future review.