CISA, FBI and international partners publish a joint advisory on SafePay ransomware, which they say has affected at least 600 organisations

TLDR

• CISA, the FBI, the Secret Service and international partners issued a joint advisory on SafePay ransomware.¹²
• CISA says SafePay has affected at least 600 organisations across multiple critical infrastructure sectors since August 2024.²
• Entry is through exposed credentials, brute force and VPN access, and known vulnerabilities in internet-facing devices; backups are targeted.¹²

CISA says it, the FBI, the US Secret Service and international partners released a joint #StopRansomware advisory on 21 October on SafePay, which it calls one of the most active ransomware groups of 2026.¹ BleepingComputer lists the other co-authors as Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit.² The advisory provides tactics, techniques and procedures, indicators of compromise and mitigations.¹

The counts are worded differently across the two sources. CISA's announcement says the group has affected approximately 600 victims across sectors in the Americas, Europe and Australia, and quotes the FBI's Brett Leatherman as saying SafePay has targeted more than 600 victims worldwide across multiple critical infrastructure sectors.¹ BleepingComputer quotes the advisory as saying at least 600 organisations from multiple critical infrastructure sectors since August 2024, and notes the group lists only victims who do not pay on its leak site, so the true number is likely higher.²

According to CISA, SafePay actors gain access by compromising credentials and targeting known vulnerabilities in internet-facing devices, often connecting through virtual private network (VPN) services.¹ BleepingComputer quotes the advisory as naming credential exposure, brute force password attacks and VPN access, particularly IP addresses of the VPN provider Mullvad, and as saying the group also uses phished account profiles and automated scripts to exploit CVEs in edge devices and other internet-exposed systems.² Once inside, CISA says, they use legitimate IT tools to move through networks, delete or disable backups, steal data and encrypt systems, then pressure victims by threatening to publish stolen information and sometimes by calling them directly.¹ BleepingComputer adds that the advisory describes deleting shadow copies and resetting network-attached storage devices that hold backups, and covers activity observed between November 2024 and August 2026 in FBI, Secret Service and Landeskriminalamt Rheinland-Pfalz investigations.²

The recommended mitigations are to keep operating systems, software and firmware up to date, require multifactor authentication, prioritise patching known exploited vulnerabilities in internet-facing systems, keep and test offline backups, and segment networks.¹ BleepingComputer adds restricting administrative tools and privileges and applying identity, credential and access management policies, and says the advisory warns that paying a ransom does not guarantee recovery and urges victims to report incidents to law enforcement.² BleepingComputer also notes that SafePay emerged in August 2024 as a private group that does not work with affiliates, and has become one of the most active operations since the start of 2025.²

Why it matters: the advisory gives defenders a named, current set of behaviours and indicators for one of the busiest ransomware groups, and its emphasis on VPNs, firewalls and other edge devices points to where patching and credential hygiene matter most.¹²