CISA and FBI: SafePay ransomware breached over 600 critical infrastructure orgs

Past-week coverage · Original source published 2026-10-21.

CISA says the SafePay ransomware gang has breached at least 600 critical infrastructure organizations worldwide since August 2024, spanning North America, South America, Europe and Australia. The agency published the figure in a joint advisory with the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency and North West Regional Organised Crime Unit.

The co-authoring agencies said paying a ransom does not guarantee that encrypted files will be recovered, and urged victims to report incidents to law enforcement.

According to the advisory, SafePay actors get in through credential exposure, brute-force password attacks and abuse of VPN access, including IP addresses tied to VPN provider Mullvad. The agencies also described phished account profiles and automated scripts that exploit vulnerabilities in edge devices and other internet-exposed systems. Once inside, the group may delete shadow copies and reset network-attached storage devices holding backups, the advisory says.

Defenders are advised to restrict administrative tools and privileges to limit lateral movement, apply MFA and identity, credential and access management policies, and prioritize patching flaws in VPNs, firewalls and other edge devices listed in CISA's catalog of actively exploited vulnerabilities.

The advisory includes indicators of compromise and tactics drawn from investigations covering activity observed between November 2024 and August 2026. SafePay, which emerged in August 2024, operates without affiliates and uses double extortion, stealing data before encrypting systems.