CISA: SafePay ransomware hit over 600 critical infrastructure orgs
Since August 2024 the private group has used stolen or brute-forced credentials, VPN access, phishing, and edge-device flaws, then double-extorted victims.
CISA, with the FBI, U.S. Secret Service, German state police, and UK agencies, says SafePay has hit businesses and critical infrastructure in North America, South America, Europe, and Australia, including at least 600 critical-infrastructure organizations since August 2024. The group does not use affiliates. It steals data before encryption, may delete shadow copies and reset NAS backups, and lists only non-paying victims on its leak site. Agencies say paying a ransom does not guarantee file recovery and urge reporting.
Unconfirmed: CISA’s figure is at least 600 organizations; the article says the true victim count is higher because only non-payers are listed.
- Initial access includes exposed credentials, password brute force, and Mullvad VPN addresses.
- Actors use phished accounts and automated scripts against edge-device CVEs.
- Observed activity in the advisory spans November 2024 to August 2026.
- SafePay emerged in August 2024 and has filled activity left by BlackCat and LockBit, the report says.
Impact: Data theft and encryption of critical-infrastructure systems
- 1.Restrict administrative tools and privileges to limit lateral movement.
- 2.Require MFA and identity, credential, and access management controls.
- 3.Patch VPNs, firewalls, and edge devices, prioritizing CISA’s exploited-vulnerability catalog.
- ATT&CK
- T1110 Brute ForceT1133 External Remote ServicesT1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for ImpactT1490 Inhibit System Recovery
- Products
- Mullvad
- Threat actors
- SafePay
- Organizations
- CISAFBIU.S. Secret ServiceNational Crime Agency
From the original article
2 min read at bleepingcomputer.com
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.