CISA: SafePay ransomware has breached 600+ critical infrastructure orgs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), together with the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency and North West Regional Organised Crime Unit, has issued a joint report on the SafePay ransomware group.

According to the agencies, the gang has breached at least 600 organizations across multiple critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024. SafePay is described as one of the most active ransomware groups in the world.

How the attackers operate

SafePay gains initial access through various means: exposed credentials, brute-force password attacks, and exploiting VPN access — notably the IP addresses of the provider Mullvad. The actors also use phished account profiles to infiltrate networks and exploit known vulnerabilities (CVEs) in edge devices and internet-exposed systems via automated scripts.

Once they hold valid credentials, the attackers move laterally. To hamper recovery, they delete shadow copies and reset network-attached storage devices holding backups. The group also relies on double extortion: stealing sensitive documents before encrypting systems and threatening to leak them if the ransom goes unpaid.

Advice for defenders

The report's authors urge administrators to restrict administrative tools and privileges to block lateral movement after a compromise, and to implement multifactor authentication and identity, credential, and access management (ICAM) policies. They also stress keeping VPNs, firewalls, and other edge devices patched, especially for flaws added to CISA's catalog of actively exploited vulnerabilities.

The agencies remind victims that paying a ransom does not guarantee recovery of encrypted files, and urge organizations to report incidents to law enforcement.

Unlike similar operations, SafePay emerged in August 2024 as a private group that does not work with affiliates. Its dark web leak site already lists hundreds of victims, but the true number of breached organizations is higher, since only those who refuse to pay end up there. Since early 2025 SafePay has gradually filled the gap left by BlackCat (ALPHV) and LockBit. The advisory also includes indicators of compromise and descriptions of tactics observed in investigations between November 2024 and August 2026.

Source: Bleeping Computer