The ransomware crew that factory-resets your backup drive first

Most ransomware encrypts your files. SafePay goes hunting for the copies first. The joint advisory published on 20 October by CISA, the FBI, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and Britain's National Crime Agency sets out the order of operations: halt the Volume Shadow Copy Service, reset any network-attached storage device within reach to its factory settings, and only then start encrypting. Files come back carrying a .SafePay extension and no way to open them.

The scale: at least 600 victims across North America, South America, Europe and Australia since August 2024, which the agencies describe as a floor rather than a ceiling, since the group only names the victims who refuse to pay. SafePay works as a closed crew instead of renting its malware to affiliates, and gets in through leaked passwords, brute force, phishing, and unpatched VPN and firewall gear at the edge of a network. The advisory notes attackers connecting through Mullvad VPN addresses, which describes where the intruders came from rather than any problem with Mullvad or with the people who use it.

You are not a critical infrastructure operator, but you own both of the things SafePay destroys. Volume Shadow Copy is what File History and "restore previous versions" quietly depend on. And plenty of households now keep every photo they have ever taken on a NAS box in a cupboard, permanently powered and permanently connected, which is exactly the device that gets wiped. A backup that is always plugged in is a backup an attacker can reach. CISA's own line deserves repeating: paying ransoms does not guarantee recovery of files.

The answer is unglamorous. Tendvane's one-click backup copies Documents, Pictures and Desktop to a drive you choose, and if you unplug that drive when it finishes, nothing on the network can get to it.