The SafePay ransomware group has targeted more than 600 critical infrastructure organizations worldwide since 2024, according to a joint advisory by the Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies.
The FBI, CISA, United States Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency, and the United Kingdom’s North West Regional Organised Crime Unit jointly authored the report.
The joint security advisory ranked SafePay ransomware among the most active in 2026, with victims spread worldwide, from the Americas to Europe and Australia.
It listed the group’s tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) and advised network defenders to implement the recommended mitigations.
SafePay ransomware targets over 600 critical infrastructure organizations
CISA and partner agencies warned that SafePay ransomware has compromised over 600 critical infrastructure organizations across North America, South America, Europe, and Australia.
“Since SafePay first came onto the scene in 2024, it’s added 595 victims to its data leak site,” said Rebecca Moody, Head of Data Research at Comparitech. “The 595 added to its site are likely companies that haven’t met its ransom demands, meaning there are probably many more that have paid the gang to either have their systems decrypted or their stolen data deleted. The fact that CISA has seen over 600 attacks across critical infrastructure sectors alone only adds to this likelihood.”
“Of the 595 victims we’ve logged through our tracker, 94 of these attacks have been confirmed by the entity involved. Data breach notifications issued in these confirmed attacks have seen nearly 20 million individual records affected,” noted Moody. “Key targets for the group include healthcare (47 attack claims in total), manufacturers (97 attack claims in total), retailers (47 attack claims in total), and government organizations (31 attack claims in total).”
SafePay ransomware employs tactics to gain initial access, including brute-forcing passwords, using compromised credentials, compromising VPNs, and exploiting security vulnerabilities.
The exploited security flaws include information disclosure, authentication bypass, missing authentication for critical functions, deserialization of untrusted data, and improper access control vulnerabilities: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766, respectively. While the security advisory lists SafePay TTPs, other ransomware groups such as Akira employ similar tactics.
“SafePay hit at least 600 organizations without a single zero-day,” said Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs. “The joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) lists five vulnerabilities used for initial access, the newest published in September 2024, the oldest patched more than six years ago. Six hundred critical infrastructure organizations had years of free scanner coverage and Known Exploited Vulnerabilities catalog entries for every one of these flaws, and still never got the window to apply them.”
After gaining access, SafePay employs living off the land (LOTL) techniques by leveraging legitimate Windows administrative tools to escalate privileges, traverse laterally, gain persistence, and exfiltrate data. SafePay ransomware uses FileZilla, 7-Zip, RClone, and WinRAR to compress data and WinSCP and RClone to exfiltrate data.
“Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones,” the agencies wrote. “They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection.”
The group also disables security software and changes privileged users’ passwords to lock them out of the system, preventing any containment measures.
The ransomware group also uses AnyDesk and TeamViewer to maintain persistence, halt the Volume Shadow Copy Service to stop backups, and reset Network Attached Storage to prevent recovery efforts.
“SafePay actors may disrupt recovery operations by deleting shadow copies and resetting network-attached storage devices containing backups,” the agencies warned.
The last step involves encrypting the victim’s files and dropping a ransom note demanding payment in cryptocurrency. According to the cybersecurity advisory, SafePay is a double-extortion ransomware group that threatens to leak stolen data online to force victims to pay. It contacts the victim organization through a representative to negotiate, and lists organizations that refuse to pay on a dark web leak site.
However, the FBI warns that paying the ransom does not guarantee recovery of the encrypted files and urges impacted critical infrastructure organizations to report extortion attempts.
“This particular attack is interesting for two pretty mundane reasons,” said John Strand, Owner, Black Hills Information Security. “First, they’re going after municipalities and critical infrastructure because, as we keep finding out, these organizations will pay. Look at how many people are affected when services go down. Add the political pressure to get those services restored, and attackers see a good chance of getting paid.”
CISA’s guidelines on defending critical infrastructure against SafePay ransomware
The authoring agencies advised network defenders to limit the threat actor’s activity by restricting administrative privileges to necessary users, implementing multi-factor authentication, protecting credentials, and implementing security controls.
They also advised network defenders to update and harden VPNs, firewalls, and other edge devices to prevent the threat actor from gaining access and maintaining persistence.
Once compromised, critical infrastructure organizations should act quickly by isolating compromised hosts and beginning threat hunting.
