CISA and FBI say SafePay ransomware has hit over 600 critical infrastructure organizations

The Cybersecurity and Infrastructure Security Agency and the FBI, working with the U.S. Secret Service and cybercrime units in Germany and the United Kingdom, published a joint advisory this week saying the SafePay ransomware group has breached more than 600 critical infrastructure organizations worldwide since August 2024.

The advisory, published as AA26-293A on CISA's site, covers SafePay activity observed between November 2024 and August 2026 and lists victims across North America, South America, Europe, and Australia. Because SafePay's leak site only names organizations that refused to pay, the agencies warned the real number of breached and extorted victims is almost certainly higher than the 600 publicly identified.

SafePay emerged in August 2024 as what researchers describe as a private, closed operation — unlike ransomware-as-a-service groups such as LockBit or BlackCat (ALPHV), it does not recruit outside affiliates to carry out attacks. That structure has not slowed it down: since early 2025, SafePay has become one of the most active ransomware operations tracked by federal agencies, filling much of the gap left after law enforcement actions disrupted LockBit and BlackCat.

According to the advisory, SafePay's initial access methods rely heavily on exposed or weakly protected remote access. The group brute-forces VPN credentials and has specifically been observed using IP addresses tied to the VPN provider Mullvad to mask its infrastructure during intrusions. It also uses phished account credentials and automated scanning scripts to exploit known vulnerabilities in internet-facing edge devices such as firewalls and VPN gateways — the same class of flaws tracked in CISA's Known Exploited Vulnerabilities catalog.

Once inside a network, SafePay follows a now-familiar double-extortion playbook: exfiltrating sensitive files before deploying encryption, then threatening to publish the stolen data if a ransom isn't paid. The advisory notes the group specifically targets backup infrastructure to hamper recovery, deleting volume shadow copies on compromised Windows systems and resetting network-attached storage devices that hold backup data.

CISA and the FBI reiterated that paying a ransom does not guarantee files will be recovered or that stolen data won't be leaked anyway, and urged victims to report incidents to law enforcement rather than negotiate quietly. The advisory's recommendations for critical infrastructure operators include enforcing multifactor authentication and tighter identity and access management, restricting administrative tool usage to limit lateral movement after an initial breach, and prioritizing patches for VPN, firewall, and other edge-device vulnerabilities on CISA's exploited-vulnerabilities list. The full advisory includes indicators of compromise and MITRE ATT&CK-mapped techniques for defenders to check against their own networks, as reported by BleepingComputer.