
SafePay attackers have been observed resetting Network Attached Storage devices to factory settings to eliminate a victim’s local backup options. This aggressive maneuver highlights the group’s commitment to ensuring that affected organizations remain entirely dependent on their decryption services for recovery. As of 2026, a high-priority joint advisory has been released by a coalition including the Federal Bureau of Investigation,










