A New Federal Advisory Describes Attackers Resetting Backups to Factory Settings

Last week, the FBI, CISA, the U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom published a joint advisory on SafePay ransomware, cataloged as AA26-293A. The agencies report that the group has “impacted at least 600 separate victims from multiple critical infrastructure sectors” and that SafePay “was among the most active ransomware groups in 2026.”

The advisory does not single out the legal sector, but firm administrators should focus not on the victim count, but on a short passage in the technical details that describes what these attackers do before they encrypt anything.

The recovery plan is part of the attack

According to the advisory, SafePay operators “halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts.” The agencies add that “in some cases, SafePay threat actors deleted all network-attached backups of company data,” and state plainly that the group “disable services designed to assist in recovery of a corrupted system.”

Read that sequence in order. The attackers gain access through credentials or an exposed remote service, move laterally with standard administrative tooling, locate the file shares, exfiltrate the data, destroy the recovery path, and only then encrypt. By the time a firm notices anything, the thing it would normally reach for has already been taken away.

That reordering changes the question an administrator needs to answer. The question is not whether the firm has backups. Nearly every firm does. The question is whether those backups sit somewhere an intruder with domain credentials can reach, because any storage device the production network can see and administer is also one an attacker on that network can see and administer.

This is the same pattern we wrote about when two firms told regulators their networks held but client files still got out: the control that looked fine on paper behaved differently under pressure. A backup that restores perfectly in a test and sits on a reachable share has not been tested against this.

What the advisory actually asks for

The mitigation section is specific and worth reading as a design requirement rather than a checklist. The agencies recommend that organizations “maintain offline backups of data and regularly test and maintain backup and restoration processes” and “ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted).”

Immutability is the operative word. It means the copy cannot be changed or deleted, even by an account with full administrative rights, which is precisely the condition the advisory describes attackers as achieving. In addition, the agencies ask organizations to “require MFA for all services to the greatest extent possible,” particularly for “webmail, VPNs, and accounts that access critical systems,” and to prioritize patching internet-facing systems. Turning an advisory like this into specific changes in a firm’s environment is our work, not a task we hand back to the firm, and we do it alongside whoever already looks after technology there.

The advisory names five edge-device vulnerabilities SafePay has exploited, the oldest dating to 2020. That lines up with ground we covered recently in the joint advisory whose newest listed vulnerability was three years old and in the emergency PHP fix earlier this month. The entry points are rarely new; what has shifted is how deliberately attackers dismantle the recovery path once they’re inside.

What we do about it

At Innovative Computing Systems, backup and disaster recovery sits inside the Essential Risk Controls layer of the Innovative Managed Solution, and we treat it as a resilience design question rather than a job-completion report.

We design firm backup so that at least one copy is immutable and held outside the production network’s reach, meaning an attacker who gains administrative control of the environment still cannot alter or delete the copy the firm would restore from. We test restoration on a defined schedule and report the results, so the firm knows how long a real recovery takes before it needs to know. And we review which accounts can change backup configuration and retention settings, because that permission deserves the same scrutiny as any other privileged access. Keeping aging infrastructure in view is part of the same work, which is why we raise decisions like the Windows Server 2016 end-of-support deadline well before the date arrives.

Knowing where firm data actually lives is part of this too. Backups follow data, and data follows vendors, which is connected to the question of which legal vendors hold your client files. A recovery plan that covers the firm’s servers but not a hosted platform holding active matter files is only partially effective

You should not have to wonder

No firm administrator should have to read a federal ransomware advisory and still wonder whether the firm can actually recover. That uncertainty is preventable, and you deserve better than finding out the answer during an incident.

Innovative Computing Systems has worked exclusively with law firms since 1989, and that experience buys you resilience. We own the design, testing, and reporting, so your attorneys stay focused on client work, and you don’t get left with an unanswerable question. Safe, secure, and reliable systems are the point, and recoverability is part of what reliable means. We’ve got your back.

If you would like to know where your firm stands, request a consultation, and a Solutions Consultant will follow up to review your current backup and recovery setup with you.