CISA: SafePay ransomware hit at least 600 critical infrastructure organizations

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware group has affected at least 600 organizations across multiple critical infrastructure sectors since August 2024.

The figure appears in a joint report with the FBI, U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and North West Regional Organised Crime Unit. The agencies say SafePay has targeted organizations in North America, South America, Europe and Australia. CISA says the group's actual victim count is higher than the number on its leak site, which lists organizations that do not pay.

According to CISA, SafePay gains access through exposed credentials, brute-force password attacks, VPN access and exploitation of vulnerabilities in internet-facing systems. The agencies say attackers may use stolen account profiles, exploit edge-device flaws and delete shadow copies or reset network-attached storage devices to disrupt recovery.

The report advises network defenders to limit administrative tools and privileges, use multifactor authentication and identity, credential and access management policies, and keep systems updated, especially VPNs, firewalls and other edge devices. CISA also warns that paying a ransom does not guarantee recovery of encrypted files.

The advisory includes indicators of compromise and details of SafePay activity observed in investigations from November 2024 through August 2026. CISA describes SafePay as a private ransomware group that does not work with affiliates and uses double extortion, stealing documents before encrypting systems and threatening to publish the data.