CISA: SafePay ransomware hits over 600 critical infrastructure organizations

{"heading_1":"SafePay Ransomware's Impact","paragraph_1":"CISA reports that SafePay ransomware has breached over 600 critical infrastructure organizations worldwide since 2024, affecting businesses and critical sectors in North America, South America, Europe, and Australia.","paragraph_2":"The ransomware group, which emerged in August 2024, has added hundreds of victims from North America, South America, Europe, and Australia to its dark web leak site, but the actual number of victims it has breached and attempted to extort is higher.","paragraph_3":"SafePay uses a variety of methods to gain initial access, including credential exposure, brute force attacks, and exploiting VPN access, particularly the IP addresses of the VPN provider 'Mullvad'.","paragraph_4":"The ransomware group has also used phished account profiles to infiltrate networks and exploit common vulnerabilities and exposures (CVEs) for edge devices and other internet-exposed systems through automated scripts.","paragraph_5":"CISA advises network defenders to secure their networks against SafePay's attacks by restricting administrative tools and privileges to block lateral movement after compromise and implementing multifactor authentication (MFA) and identity, credential, and access management (ICAM) policies for better account security.","paragraph_6":"The advisory includes indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) to previous SafePay ransomware activity observed between November 2024 and August 2026 during FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations.","paragraph_7":"Unlike similar operations, SafePay emerged in August 2024 as a private ransomware group that doesn't work with affiliates. It has since added hundreds of victims from North America, South America, Europe, and Australia to its dark web leak site.","paragraph_8":"SafePay is known for double-extortion tactics, stealing sensitive documents before encrypting the victims' systems and threatening to leak all the stolen data online if a ransom isn't paid. Since the start of 2025, SafePay has slowly filled the gap left by BlackCat (ALPHV) and LockBit ransomware, becoming one of the most active ransomware operations.","paragraph_9":"Once attackers have valid credentials, only 37% of their actions are blocked. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.","paragraph_10":"CISA urges victims to report incidents to law enforcement and advises network defenders to secure their networks against SafePay's attacks by restricting administrative tools and privileges to block lateral movement after compromise and implementing multifactor authentication (MFA) and identity, credential, and access management (ICAM) policies for better account security."}