CISA warns SafePay ransomware breached over 600 critical infrastructure organizations

International joint advisory urges reporting, provides indicators of compromise

By LineZotpaper

Published21 October 2026

Read Time2 min

The Cybersecurity and Infrastructure Security Agency (CISA), together with the FBI, U.S. Secret Service, German Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency and North West Regional Organised Crime Unit, issued a joint advisory Tuesday warning that the SafePay ransomware group has breached over 600 critical infrastructure organizations across North America, South America, Europe, and Australia since August 2024. The advisory emphasizes that paying ransoms does not guarantee file recovery and urges victims to report incidents to law enforcement.

According to the advisory, SafePay actors gain initial access through credential exposure, brute force password attacks, and by exploiting VPN access, particularly IP addresses of VPN provider Mullvad. They also use phished account profiles and automated scripts to exploit CVEs in edge devices and internet-exposed systems. Once inside, they employ double-extortion tactics: stealing sensitive data before encrypting systems and threatening to leak the data on their dark web leak site if ransoms are not paid.

SafePay emerged in August 2024 as a private ransomware group that does not use affiliates. Since then, it has become one of the most active ransomware operations, particularly after the decline of groups like BlackCat (ALPHV) and LockBit. The advisory notes that SafePay may disrupt recovery operations by deleting shadow copies and resetting network-attached storage devices containing backups.

The co-authoring agencies provide indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) from investigations conducted between November 2024 and August 2026. Network defenders are advised to restrict administrative tools and privileges, implement multifactor authentication and identity, credential, and access management (ICAM) policies, and keep systems updated, focusing on VPNs, firewalls, and other edge devices in CISA's catalog of actively exploited vulnerabilities.

Analysis

Why This Matters

The breach of over 600 critical infrastructure organizations worldwide demonstrates the global and persistent threat of ransomware.
The joint advisory from US, German, and UK law enforcement agencies underscores the need for international cooperation against cybercrime.
SafePay's growth following the disruption of other ransomware groups shows how quickly the threat landscape evolves.

Background

SafePay emerged in August 2024 as a private ransomware operation, distinct from affiliate-based models. Since then, it has steadily increased its activity, particularly after the takedowns or declines of other prominent groups like BlackCat (ALPHV) and LockBit. SafePay focuses on double extortion: it steals data before encryption and threatens to leak it if ransoms are not paid. The group is one of the most active ransomware operations, targeting critical infrastructure across multiple continents.

Key Perspectives

CISA and international law enforcement: They emphasize that paying ransoms does not guarantee file recovery and encourage victims to report incidents. The advisory provides technical details including IOCs and recommended mitigations. Critical infrastructure organizations: As the primary targets, they face operational disruptions, data theft, and extortion demands. The advisory provides them with actionable guidance to defend against attacks. Network defenders and security teams: The advisory offers specific measures: restricting administrative privileges, implementing MFA and ICAM policies, patching VPNs and edge devices, and protecting backups from deletion.

What to Watch

Whether SafePay's victim count continues to grow and if it adapts methods after this advisory's publication.
Further law enforcement actions or takedowns targeting the group.
The extent to which recommended defenses are adopted by critical infrastructure organizations.

Sources

CISA: SafePay ransomware hit over 600 critical infrastructure orgs · BleepingComputer

Checked

12 claims in this story checked against 1 source: 9 supported.

Show each claim

SupportedCISA says SafePay breached over 600 critical infrastructure organizations.BleepingComputer: “CISA: SafePay ransomware hit over 600 critical infrastructure orgs. The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024.”
Partly supportedSafePay breached over 600 organizations across North America, South America, Europe and Australia since August 2024.BleepingComputer: “SafePay is one of the most active ransomware groups and have affected businesses and critical infrastructure in North America, South America, Europe, and Australia—including at least 600 organizations from multiple critical infrastructure sectors since August 2024,”
SupportedCISA and the named US, German and UK agencies issued a joint advisory.BleepingComputer: “In a joint report with the FBI, the U.S. Secret Service (USSS), Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency and North West Regional Organised Crime Unit”
Not in the sourcesThe advisory was issued Tuesday.
SupportedThe advisory says paying ransoms does not guarantee recovery of encrypted files.BleepingComputer: “the federal agency added that paying ransoms does not guarantee recovery of files encrypted in ransomware attacks”
SupportedThe advisory urges victims to report incidents to law enforcement.BleepingComputer: “urged victims to report incidents to law enforcement.”
SupportedSafePay gains initial access through credential exposure, brute-force password attacks and VPN access, particularly IP addresses of Mullvad.BleepingComputer: “SafePay threat actors gain initial access through a variety of means, including credential exposure, brute force password attacks, and exploiting virtual private network (VPN) access—particularly the IP addresses of VPN provider 'Mullvad'.”
SupportedSafePay uses phished account profiles and automated scripts to exploit CVEs in edge devices and other internet-exposed systems.BleepingComputer: “They also use phished account profiles to infiltrate networks and exploit common vulnerabilities and exposures (CVEs) for edge devices and other internet-exposed systems through automated scripts,”
SupportedSafePay uses double-extortion tactics, stealing sensitive documents before encryption and threatening to leak the data if a ransom is not paid.BleepingComputer: “This ransomware group is also known for double-extortion tactics, stealing sensitive documents before encrypting the victims' systems and threatening to leak all the stolen data online if a ransom isn't paid.”
SupportedSafePay emerged in August 2024 as a private ransomware group that does not work with affiliates.BleepingComputer: “SafePay emerged in August 2024 as a private ransomware group that doesn't work with affiliates.”
Partly supportedSafePay became one of the most active ransomware operations particularly after the decline of BlackCat and LockBit.BleepingComputer: “Since the start of 2025, SafePay has slowly filled the gap left by BlackCat (ALPHV) and LockBit ransomware, becoming one of the most active ransomware operations .”
SupportedSafePay may disrupt recovery by deleting shadow copies and resetting network-attached storage devices containing backups.BleepingComputer: “SafePay actors may disrupt recovery operations by deleting shadow copies and resetting network-attached storage devices containing backups.”