How Compromised Access Enables Network-Wide Attacks
What the latest CISA and FBI advisory reveals about credential compromise, administrative access, and lateral movement.
Ransomware attacks often involve more than deploying malicious software. Before files are encrypted, attackers may spend time gaining access to accounts, identifying valuable systems, and moving through a network using tools administrators rely on every day.
A new joint cybersecurity advisory from the Cybersecurity and Infrastructure Security Agency (CISA), FBI, U.S. Secret Service, and international law enforcement partners documents how the SafePay ransomware group uses these techniques to compromise organizations.
According to the October 20, 2026, SafePay ransomware advisory, the group has affected at least 600 victims since August 2024, including organizations across multiple critical infrastructure sectors. Investigations identified several methods of initial access, including compromised credentials, brute-force password attacks, phishing, and exploitation of vulnerabilities in internet-facing systems.
What makes the advisory particularly relevant for enterprise security teams is how SafePay operators expand their access once inside a network. Rather than relying exclusively on malicious tools, attackers use existing accounts, remote administration utilities, and Windows capabilities to move between systems and prepare for ransomware deployment.
The advisory identifies several ways SafePay operators gain their initial foothold.
Investigators observed credential exposure, brute-force password attacks, and the abuse of virtual private network (VPN) access. SafePay actors also exploited known vulnerabilities in internet-facing devices and used compromised account profiles to access victim environments.
These findings demonstrate why initial access remains difficult to defend against with a single security control.
A vulnerable VPN appliance may provide an entry point even when account credentials are secure. Conversely, an attacker who obtains a valid password may be able to authenticate without exploiting a software vulnerability.
For organizations, both scenarios require attention. Patching internet-facing systems reduces exposure to known vulnerabilities, while strengthening authentication and identifying compromised passwords can reduce opportunities for credential-based access.
The distinction matters because a valid password is not necessarily a safe password. If an employee’s credentials have appeared in a known breach, an attacker may be able to use them against corporate services where they remain active.
Identifying that exposure before the credentials are exploited provides an opportunity to require remediation and limit unauthorized access.
One of the more significant findings in the SafePay advisory concerns what happens after attackers establish access.
Investigators observed SafePay operators obtaining administrative privileges through existing accounts or creating additional accounts to maintain access. The group also used privilege escalation and token impersonation techniques to execute commands with elevated permissions.
This activity can turn an initial compromise into a broader network intrusion.
Administrative privileges allow attackers to perform actions that ordinary users cannot, including accessing additional systems, changing configurations, and executing commands across an environment.
The advisory also describes SafePay operators changing user passwords in some incidents, preventing legitimate users from signing in. This demonstrates how compromised access can be used not only to steal information but also to interfere with an organization’s ability to respond.
For security teams, the concern extends beyond whether an attacker initially obtained a password through phishing, brute force, or another method. Once an account is compromised, its permissions and available access paths influence how much damage the attacker can cause.
That makes privileged account protection, access restrictions, and monitoring for suspicious account activity essential parts of ransomware defense.
SafePay’s use of legitimate administrative tools is another important aspect of the advisory.
Investigators identified the group’s use of PsExec, Windows Remote Management (WinRM), and Remote Desktop Protocol (RDP) to move through compromised environments. SafePay operators also used remote monitoring and management software to execute commands and access additional systems.
These tools serve legitimate business purposes. Administrators use them to maintain systems, troubleshoot problems, and manage infrastructure.
In the hands of an attacker, however, the same capabilities can support lateral movement.
The advisory describes SafePay operators searching for credentials that would provide administrative access as they moved through networks. When necessary, they created additional accounts.
This approach can complicate detection because individual administrative actions may resemble authorized IT activity. The surrounding context becomes important: which account performed the action, whether the activity was expected, and whether the account recently exhibited other signs of compromise.
Organizations should therefore pay particular attention to unexpected administrative logins, unusual remote access patterns, and new privileged accounts.
Restricting administrative tools to authorized users and limiting unnecessary privileges can also reduce the opportunities available to an attacker who has already gained access.
The SafePay advisory includes findings directly relevant to organizations operating Windows and Active Directory environments.
In several incidents, investigators observed attackers using ShareFinder.ps1, a PowerShell script that enumerates network file shares in Windows Active Directory environments. SafePay operators also used SharpShares.exe to identify shared resources.
These tools helped attackers locate potentially valuable information for theft.
The advisory also documents credential-related activity during lateral movement, including efforts to obtain administrative access and establish control over additional systems.
These findings do not mean that every SafePay incident involved an Active Directory compromise. They do show how attackers can exploit account privileges and Windows administrative capabilities after entering an enterprise network.
For organizations relying on Active Directory, password security remains an important part of limiting this risk.
An employee or administrator password may satisfy an organization’s password policy while also appearing in known compromised credential datasets. If that password remains active, it can create an opportunity for unauthorized authentication.
Continuous compromised-password monitoring helps organizations identify these exposures rather than relying solely on password requirements or checks performed when passwords are created.
This is particularly relevant in environments where a compromised account may have access to shared resources, administrative tools, or other systems that attackers could target during lateral movement.
Password monitoring cannot prevent every technique described in the SafePay advisory. However, reducing the number of active compromised passwords can help close off one potential route into the environment.
SafePay’s activity does not stop at gaining access or moving between systems.
According to the advisory, attackers use legitimate file management and transfer utilities, including 7-Zip, RClone, WinSCP, and FileZilla, to collect and exfiltrate information. Investigators also observed the use of OneDrive for data exfiltration in some incidents.
The group then encrypts files and demands payment, using the threat of publishing stolen information to increase pressure on victims.
SafePay operators have also taken steps to undermine recovery efforts. The advisory describes attackers stopping the Volume Shadow Copy Service and resetting network-attached storage containing backup data.
These activities demonstrate why the consequences of ransomware can extend beyond encrypted files.
An organization may face data exposure, operational disruption, and impaired recovery capabilities before or during the encryption phase.
By the time ransomware is deployed, attackers may already have established significant control over the environment.
That makes earlier opportunities for detection and containment particularly valuable.
The SafePay advisory reinforces the importance of addressing both initial access vulnerabilities and the opportunities attackers exploit after gaining a foothold.
CISA and its partners recommend measures that include patching known vulnerabilities, strengthening identity and access management, enforcing multifactor authentication, restricting administrative privileges, and protecting backups.
For organizations evaluating their credential security practices, several priorities stand out.
Identify and remediate compromised passwords. Screening Active Directory passwords against known compromised credential data can help identify accounts that may be vulnerable to credential-based attacks. Continuous monitoring also helps detect passwords that become exposed after they are established.
Strengthen privileged account security. Administrative access should be limited to users who require it. Organizations should review privileged accounts, remove unnecessary permissions, and investigate unexpected account creation or changes.
Protect remote access. Enforce MFA where supported, restrict access to VPNs and remote administration services, and promptly remediate vulnerabilities in internet-facing systems.
Monitor account activity and lateral movement. Unusual authentication patterns, unexpected use of administrative tools, and suspicious changes to account privileges can provide indications that an attacker is expanding access.
Maintain reliable recovery capabilities. Offline or otherwise protected backups, network segmentation, and tested recovery procedures help reduce the operational impact if an intrusion progresses to ransomware deployment.
Enzoic for Active Directory supports the credential security portion of this approach by identifying compromised passwords and continuously monitoring Active Directory accounts for newly discovered exposure. Organizations can use that intelligence to remediate password risks before exposed credentials are exploited.
These capabilities complement broader identity security, endpoint protection, vulnerability management, and incident response controls.
The SafePay advisory provides a detailed example of how attackers can combine credential compromise, administrative access, and legitimate system tools to expand their control of an enterprise environment.
The group’s activity also reinforces an important distinction: preventing ransomware is not limited to detecting malicious encryption.
Organizations need to reduce the opportunities attackers have to establish access, obtain privileges, and move through their networks.
Identifying compromised passwords is one part of that effort. Combined with strong access controls, timely patching, and monitoring for suspicious activity, it can help organizations reduce the risks that allow an initial intrusion to become a network-wide incident.
Learn how Enzoic for Active Directory helps organizations identify compromised passwords and strengthen Active Directory security.