CISA Warns SafePay Ransomware Hit 600+ Critical Groups
A joint international advisory details how the SafePay ransomware group has targeted hundreds of critical infrastructure organizations worldwide since 2024.
Radwan AbdulhadiEditor and technology writer
Global Impact on Critical Infrastructure
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an official alert warning that the [SafePay] ransomware gang has successfully breached over 600 critical infrastructure organizations worldwide since 2024. According to details released in a [joint report], the campaign has impacted multiple sectors across North America, South America, Europe, and Australia.
[CISA said] that the threat actors have established themselves as [one of the most active ransomware operations] globally. The organization, along with its international partners, stressed that paying ransoms does not guarantee the recovery of encrypted files and strongly urged victims to report all incidents immediately to law enforcement.
Initial Access Vectors and Attack Methods
Federal investigators outline that SafePay threat actors gain initial access to targeted networks through various techniques. Common entry points include credential exposure, brute force password attacks, and the exploitation of virtual private network access, with specific attention directed toward the IP addresses of the VPN provider 'Mullvad'.
In addition to network perimeter breaches, the threat actors utilize phished account profiles to infiltrate networks. They also exploit common vulnerabilities and exposures on edge devices and other internet-exposed systems using automated scripts. Once inside, they may disrupt recovery operations by deleting shadow copies and resetting network-attached storage devices that contain backups.
Operations and Extortion Tactics
Emerging in August 2024, SafePay operates as a private ransomware group that does not work with affiliates, differentiating it from many similar criminal models. Since its inception, the group has added hundreds of victims to its dark web leak site. However, security analysts note that the actual number of breached organizations is likely higher, as the platform only lists victims who refuse to pay.
The group is well-known for utilizing aggressive double-extortion tactics. Attackers exfiltrate sensitive documents before initiating system encryption, subsequently threatening to publish the stolen data online if the ransom demands are not met. Since the beginning of 2025, the group has gradually filled the operational space left by previous criminal entities like BlackCat and LockBit.
Defense Recommendations and Guidance
Co-authoring international agencies have urged network defenders to secure their environments by implementing strict administrative controls. Recommendations include restricting administrative tools and privileges to block lateral movement after an initial compromise, alongside deploying multifactor authentication and robust identity, credential, and access management policies.
Security teams are advised to maintain updated systems with a primary focus on patching vulnerabilities affecting VPNs, firewalls, and edge devices. Organizations should regularly review [CISA's catalog of actively exploited vulnerabilities] to prioritize remediation efforts against flaws frequently targeted by ransomware operators.
Technical Indicators and Resource Data
The comprehensive advisory provides detailed technical documentation to assist defensive operations. Organizations can review specific [indicators of compromise (IOCs)] and analyze the documented [tactics, techniques, and procedures (TTPs)] compiled from investigations conducted between November 2024 and August 2026.
Furthermore, broader industry analyses underscore the challenges of post-compromise defense. Data indicates that [Once attackers have valid credentials, only 37% of their actions are blocked], highlighting the critical importance of foundational access controls and continuous behavioral monitoring across production environments.
Sources
- BleepingComputerCISA: SafePay ransomware hit over 600 critical infrastructure orgs
Continue chronologically
Related stories
FBI Flags Over 600 Addresses Tied to North Korea Binance Heist
The FBI flags over 600 crypto addresses linked to North Korean state-sponsored hackers following the record-breaking Binance breach.
CISA Warns Ransomware Gangs Are Exploiting TeamCity Flaw
CISA alerts federal agencies that ransomware gangs are now actively exploiting a critical JetBrains TeamCity authentication bypass vulnerability.
FortiBleed Campaign Locks Victims Out of Fortinet Devices
The ongoing FortiBleed campaign has compromised tens of thousands of Fortinet devices globally, with attackers locking organizations out completely.
CISA Warns of Actively Exploited Plex Flaws in Attacks
CISA warns that hackers are actively exploiting four chained Plex Media Server vulnerabilities, known as Plex2Shell, to breach servers.