Key points
- SafePay has compromised approximately 600 organisations across critical infrastructure sectors.
- Attackers gain access via stolen credentials, phishing, and exploited vulnerabilities.
- CISA, FBI and partners urge urgent patching and forensic triage of systems.
Security operations teams in the Americas, Europe and Australia face an urgent warning regarding SafePay ransomware. The U.S. Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation and the U.S. Secret Service issued a joint advisory stating the group has compromised roughly 600 organisations. These victims span multiple critical infrastructure sectors worldwide.
The agencies report that SafePay has been highly active since August 2024. Threat actors typically establish initial access by stealing or guessing passwords, exploiting known vulnerabilities in security systems or using phishing campaigns. Once inside a network, they create new accounts or take over existing ones to maintain control.
Tactics and Techniques
According to the joint advisory, SafePay actors use legitimate system tools to move laterally through compromised networks. They identify valuable files and disable security protections to avoid detection by defensive teams. Following this reconnaissance, the group encrypts the victim’s files, rendering them inaccessible. They then leave a ransom note demanding payment in cryptocurrency.
Public-facing devices with known vulnerabilities remain a frequent target for this group. Chris Butera, acting executive assistant director for cybersecurity at CISA, stated that public-facing devices continue to be targeted. He urged organisations to review and implement recommended mitigations, including urgently patching known exploited vulnerabilities listed in the advisory.
Scope of Impact
The FBI and its partners emphasised that network defenders need clear guidance to protect their organisations. Brett Leatherman, assistant director of the FBI’s cyber division, noted that SafePay actors have already targeted more than 600 victims. These victims are located across multiple critical infrastructure sectors globally. The agencies aim to help defenders reduce both the likelihood and the impact of such attacks.
Our take on the response
The joint advisory urges organisations to conduct forensic triage to determine if their systems have been compromised. Patching known exploited vulnerabilities is highlighted as a critical immediate step. The agencies suggest that following these recommendations can significantly reduce the risk posed by one of 2026’s most active ransomware groups. No specific software versions were named in the provided text, but the focus is on closing known gaps.
What affected people can do
Teams should verify whether any public-facing systems have unpatched vulnerabilities known to be exploited by ransomware groups. Check for unusual account creations or privilege escalations that do not match normal operational patterns. Monitor for legitimate administrative tools being used in unexpected ways, which may indicate lateral movement. Be alert for phishing attempts that mimic internal communications or emergency alerts, as these often follow major security incidents to harvest further credentials.
Background: Threat actors
Threat actors in cybersecurity are individuals or groups who intentionally compromise systems to steal data, disrupt operations or extort money. They range from lone hackers to state-sponsored teams. Defending against them requires analysing behaviour, not just blocking known malicious files or IP addresses.
Read the full guide: Threat Actors in Cybersecurity: Tactics, Profiles and Detection Strategies
What to do and how to stay safe: SafePay
- Audit public-facing devices for known vulnerabilities and apply patches immediately according to vendor guidance.
- Review account activity for new or modified user accounts that were not created by authorised personnel.
- Monitor logs for the use of legitimate system tools in unusual contexts or at odd hours.
- Conduct forensic triage on critical systems to check for signs of compromise such as disabled security controls.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many organisations have been compromised by SafePay?
According to the joint advisory, SafePay has compromised roughly 600 organisations worldwide.
When did SafePay become highly active?
The agencies state that the group has been highly active since August 2024.
How do SafePay actors typically gain access?
They steal or guess passwords, exploit vulnerabilities in security systems, and use phishing campaigns.