CISA says SafePay hit at least 600 critical infrastructure organizations
Original title: SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
A US, German and UK advisory says the group, active since August 2024, uses double extortion across four regions.
CISA and agencies from Germany and the United Kingdom warned on October 20, 2026, that SafePay has compromised at least 600 critical infrastructure organizations since August 2024, spanning North America, South America, Europe and Australia. Initial access includes exposed credentials, password brute force, VPN access and edge-device vulnerabilities. Operators then use built-in administration tools, RDP, security disabling and common transfer utilities before encrypting files with ChaCha20 and RSA and pressuring victims by phone.
Unconfirmed: SafePay’s suspected links to LockBit, ALPHV/BlackCat, INC Ransomware and the Conduent attack are described as beliefs, not confirmed.
- NCC Group counted 70 claimed SafePay attacks in May 2026.
- A June 2026 BlacKite report ranked the group third early in 2026, with a Germany focus.
- Exfiltration tools named include FileZilla, OneDrive, 7-Zip, RClone and WinRAR.
- Ransom notes direct victims to a Tor chat using a victim ID.
- Conduent agreed on October 16, 2026, to pay $80 million over a November 2024 breach.
Impact: Data theft and file encryption for ransom at victim organizations
- 1.Prioritize known exploited vulnerabilities and keep operating systems, software and firmware updated.
- 2.Require MFA and apply identity, credential and access-management policies.
- 3.Maintain offline, encrypted, immutable backups and segment networks against ransomware spread.
From the original article
3 min read at infosecurity-magazine.com
A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the group’s tactics
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.