SafePay Ransomware Has Hit More Than 600 Critical Infrastructure Organizations, CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware group has infiltrated more than 600 critical infrastructure organizations worldwide since 2024.

In a joint advisory, CISA, the FBI, the U.S. Secret Service (USSS), Germany’s Rhineland-Palatinate State Crime Service, the United Kingdom’s National Crime Agency, and the Northwestern Regional Organized Crime Task Force warned that paying a ransom does not guarantee the recovery of encrypted files. The agencies also urged ransomware victims to report incidents to law enforcement.

SafePay Has Targeted More Than 600 Organizations

“SafePay is one of the most active ransomware groups, impacting businesses and critical infrastructure in North America, South America, Europe, and Australia, including at least 600 organizations across multiple critical infrastructure sectors since August 2024,” CISA said.

The ransomware group uses multiple methods to gain initial access, including compromised credentials, brute-force password attacks, and VPN access. CISA specifically noted the exploitation of the IP address of VPN provider Mullvad.

How SafePay Gains Initial Access

According to the advisory, SafePay attackers also use phishing account profiles and automated scripts to exploit common vulnerabilities and exposures (CVEs) affecting edge devices and other systems exposed to the internet.

Security teams should prioritize vulnerabilities affecting VPNs, firewalls, and other edge devices. These systems are frequently targeted because they can provide an entry point into a victim’s network. Organizations should also regularly review the CISA Catalog of Actively Exploited Vulnerabilities.

SafePay Uses Data Theft and File Encryption

SafePay uses a dual-extortion strategy. The group steals sensitive documents before encrypting a victim’s systems, then threatens to publish the stolen data online if the ransom is not paid.

“A SafePay attacker could disrupt recovery operations by deleting shadow copies or resetting network-attached storage devices containing backups,” CISA added.

SafePay has also listed hundreds of victims from North America, South America, Europe, and Australia on its dark web leak site. Because the group only lists organizations that do not pay to be removed from the platform, the total number of organizations breached or targeted for extortion may be higher.

CISA Recommendations for Defending Against SafePay

The agencies advised network defenders to strengthen ransomware defenses by taking the following steps:

• Restrict administrative tools and privileges to limit lateral movement after an initial breach.
• Implement multi-factor authentication (MFA) to protect user and administrator accounts.
• Adopt identity, credential, and access management (ICAM) policies.
• Keep operating systems, VPNs, firewalls, and other internet-facing systems up to date.
• Prioritize vulnerabilities listed in the CISA Catalog of Actively Exploited Vulnerabilities.
• Protect backups and recovery infrastructure from unauthorized deletion or modification.

SafePay Activity and Links to BlackCat and LockBit

SafePay emerged in August 2024 as a private ransomware group with no affiliates, unlike many similar ransomware operations.

Since the beginning of 2025, SafePay has gradually closed the gap left by BlackCat (ALPHV) and LockBit, becoming one of the most active ransomware groups.

The CISA advisory also includes Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs) based on SafePay ransomware activity observed during investigations by the FBI, USSS, and Landeskriminalamt Rheinland-Pfalz between November 2024 and August 2026.

The overall prevention score can hide what happens after initial access. If an attacker uses valid credentials, your defenses can drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report