CISA: SafePay ransomware hit over 600 critical infrastructure orgs

The Cybersecurity and Infrastructure Security Agency(CISA)states the SafePay ransomware gang has actually breached over 600 vital facilities companies worldwide given that 2024.

In a joint report with the FBI, the U.S. Secret Service(USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, and the UK’s National Crime Agency and North West Regional Organised Crime Unit, the federal company included that paying ransoms does not ensure healing of files secured in ransomware attacks and prompted victims to report occurrences to police.

“SafePay is one of the most active ransomware groups and have affected businesses and critical infrastructure in North America, South America, Europe, and Australia—including at least 600 organizations from multiple critical infrastructure sectors since August 2024,” CISA stated

“SafePay threat actors gain initial access through a variety of means, including credential exposure, brute force password attacks, and exploiting virtual private network (VPN) access—particularly the IP addresses of VPN provider ‘Mullvad’.”

The co-authoring companies encouraged network protectors to protect their networks versus the ransomware group’s attacks by limiting administrative tools and opportunities to obstruct lateral motion after compromise and carrying out multifactor authentication(MFA )and identity, credential, and gain access to management(ICAM)policies for much better account security.

Security groups ought to likewise keep systems upgraded, concentrating on defects impacting VPNs, firewall softwares, and other edge gadgets contributed to CISA’s brochure of actively made use of vulnerabilities due to the fact that they’re frequently targeted in SafePay attacks for preliminary access to victims’networks.

“They also use phished account profiles to infiltrate networks and exploit common vulnerabilities and exposures (CVEs) for edge devices and other internet-exposed systems through automated scripts,” CISA included. “SafePay actors may disrupt recovery operations by deleting shadow copies and resetting network-attached storage devices containing backups.”

The advisory likewise consists of indications of compromise(IOCs) and methods, strategies, and treatments(TTPs ) to previous SafePay ransomware activity observed in between November 2024 and August 2026 throughout FBI, USSS, and Landeskriminalamt Rheinland-Pfalz examinations.

Unlike comparable operations, SafePay emerged in August 2024 as a personal ransomware group that does not deal with affiliates.

It has actually because included numerous victims from North America, South America, Europe, and Australia to its dark web leakage website, however the real variety of victims it has actually breached and tried to obtain is greater, considering that it notes just those who do not pay on its leakage platform. This ransomware group is likewise understood for double-extortion techniques, taking delicate files before securing the victims’ systems and threatening to leakage all the taken information online if a ransom isn’t paid.

Considering that the start of 2025, SafePay has actually gradually filled the space left by BlackCat(ALPHV )and LockBit ransomware, turning into one of the most active ransomware operations.