578/69 Thursday, October 22, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), together with the Federal Bureau of Investigation (FBI), U.S. Secret Service (USSS), the State Criminal Police Office of Rhineland-Palatinate in Germany, and U.K. law enforcement agencies, has issued an advisory on the SafePay ransomware group, which has remained actively involved in ransomware attacks. According to the advisory, since August 2024 the group has attacked at least 600 organizations across multiple critical infrastructure sectors in North America, South America, Europe, and Australia. CISA warned that paying a ransom does not guarantee that encrypted files will be recovered and advised affected organizations to report incidents to relevant law enforcement authorities.
Investigations found that SafePay uses multiple methods to gain initial access to target environments, including compromised credentials, brute-force attacks to guess passwords, accounts obtained through phishing, and exploitation of vulnerabilities in VPNs, firewalls, and internet-facing edge devices. Connections associated with Mullvad VPN services have also been observed during attack activity. In addition, the attackers use automated scripts to identify and exploit known vulnerabilities before moving laterally across compromised networks to expand their access. SafePay may also attempt to disrupt recovery efforts by deleting Shadow Copies and resetting Network-Attached Storage (NAS) devices used for backups, reducing the likelihood that organizations can restore their systems without paying a ransom.
SafePay has been active since August 2024 and operates as a closed ransomware group rather than through an affiliate-based model. The group uses double-extortion tactics by stealing sensitive organizational data before encrypting systems, then threatening to publish the stolen information if the victim refuses to pay. The actual number of victims may be higher than the number listed on the group’s leak site, as SafePay typically publishes only organizations that refuse to pay. CISA and partner agencies recommend that organizations promptly patch systems, particularly vulnerabilities affecting VPNs, firewalls, and edge devices listed in the Known Exploited Vulnerabilities (KEV) Catalog; restrict administrator privileges and the use of remote management tools; enforce Multi-Factor Authentication (MFA) and Identity, Credential, and Access Management (ICAM) controls; and review the published Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs) to detect and reduce the risk of SafePay ransomware activity.