FBI and CISA warn SafePay hit at least 600 organizations
Original title: FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
The independent group uses stolen or brute-forced credentials and VPN access, then steals data and appends .SafePay.
The FBI, CISA, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK agencies said SafePay has breached at least 600 organizations since August 2024, including critical infrastructure in North America, South America, Europe, and Australia. The group, which does not use affiliates, enters through exposed credentials, brute force, VPN access, and known edge-device flaws, then steals data and encrypts files. Victims are sent to a Tor chat; payment is not guaranteed to restore data.
Unconfirmed: The report says SafePay exploits known Cisco, Veeam, and SonicWall flaws but does not name the CVE identifiers.
- Findings draw on investigations through August 2026.
- Actors use Mullvad VPN addresses and phished profiles.
- Named tools include Mimikatz, PsExec, WinRM, RDP, and RClone.
- Encryption uses ChaCha20 with RSA; files gain .SafePay.
- Attackers delete Volume Shadow Copies and factory-reset NAS backups.
Impact: Encrypted systems and stolen data held for ransom
- 1.Update internet-facing VPNs and firewalls and prioritize CISA KEV vulnerabilities.
- 2.Enable MFA for VPNs, webmail, and accounts that reach critical systems.
- 3.Keep backups offline, encrypted, and immutable.
- ATT&CK
- T1110 Brute ForceT1078 Valid AccountsT1003 OS Credential DumpingT1486 Data Encrypted for ImpactT1490 Inhibit System Recovery
- Threat actors
- SafePay
From the original article
4 min read at securityaffairs.com
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.