The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the U.S. Secret Service (USSS), and international partners warned that SafePay, one of the most active ransomware groups this year, has compromised roughly 600 organizations across multiple critical infrastructure sectors in the Americas, Europe, and Australia. In a joint advisory, the agencies said the group has been highly active since August 2024, targeting businesses and critical infrastructure sites. SafePay actors typically gain initial access by stealing or guessing passwords, exploiting vulnerabilities in security systems, and phishing.
“Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection,” according to a post. “Following this, they encrypt the victim’s files, making them inaccessible, and leave a ransom note demanding payment in cryptocurrency. This advisory urges organizations to follow recommended security measures to reduce the risk and impact of SafePay ransomware attacks.”
“Public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay Ransomware group,” Chris Butera, acting executive assistant director for cybersecurity, said in a Wednesday media statement. “With our partners, CISA encourages organizations to review and implement recommended mitigations to include urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised.”
“Today, the FBI and our partners are giving network defenders clear, actionable guidance to protect their organizations from one of 2026’s most active ransomware groups,” said Brett Leatherman, assistant director of the FBI’s cyber division. “SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors. By following these recommendations, network defenders can significantly reduce both the likelihood and the impact of a SafePay ransomware attack.”
The agencies detailed that SafePay ransomware hackers typically break into networks by exploiting stolen or exposed credentials, guessing passwords through brute force attacks, and abusing virtual private network (VPN) access, often routing connections through the Mullvad VPN provider. They also exploit known vulnerabilities in internet-facing devices, sometimes using automated scripts.
Once inside, the SafePay ransomware actors gain administrative privileges, often by creating new accounts, and use legitimate tools built into the victim’s systems to move across the network and locate valuable data. They disable security software to avoid detection and, in some cases, change user passwords to lock administrators out.
The group then steals data using legitimate file transfer and compression tools, and shuts down recovery options by halting backup services and resetting network storage devices that hold backups. After exfiltrating data, the actors encrypt files with a hybrid scheme that cannot be reversed without the decryption key. SafePay typically demands a share of company revenue in cryptocurrency. The group leaves a ransom note directing victims to a chat portal on the dark web, and a representative phones victims to increase pressure. If victims do not pay, the group publishes the stolen data on its leak site.
The advisory mentioned that if organizations detect a potential compromise before ransomware actors have encrypted any data, the agencies advise them to act quickly. They should first identify which hosts were compromised and isolate them by quarantining them or taking them offline. Next, they should begin threat hunting to scope the intrusion, collecting and reviewing logs and other artifacts to determine the attackers’ tactics, the affected devices and accounts, and a timeline of activity.
To contain the incident and remove the attackers from the network, the agencies recommend applying eviction countermeasures once enough threat hunting data has been gathered to guide their selection. CISA’s Eviction Strategies Tool can help build a systematic eviction plan. It combines Playbook-NG, a web application, with COUN7ER, a database of post-compromise countermeasures mapped to adversary tactics. Together, they produce a playbook of recommended response actions, each with its intended outcome, preparatory steps, and associated risks. Finally, organizations should harden their networks to prevent further malicious activity.
The agencies urged organizations to align their defenses with the cross-sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST), a baseline set of practices meant to counter the most common and damaging threats. They said timely patching is among the most efficient and cost-effective steps available, and they advised organizations to prioritize known exploited vulnerabilities, especially in internet-facing systems, while keeping all operating systems, software, and firmware up to date.
On access controls, the agencies recommended identity, credential, and access management policies, with multifactor authentication required wherever possible, particularly for webmail, VPNs, and accounts that reach critical systems. They advised following NIST’s digital identity guidelines by requiring long passwords of at least 15 characters, storing them securely, avoiding reuse, locking accounts after repeated failed logins, and not forcing frequent password changes, which can lead users to adopt patterns attackers easily guess. Organizations should also audit administrative accounts, apply the principle of least privilege, and consider time-based access that grants elevated privileges only when needed.
To limit damage from an attack by the SafePay ransomware group, the agencies called on organizations to maintain encrypted, immutable offline backups that cover their entire data infrastructure, regularly test restoration, and keep multiple copies of sensitive data in a physically separate, secure location. They also recommended segmenting networks to restrict lateral movement and disabling command-line and scripting permissions that attackers rely on to escalate privileges.
The agencies further advised organizations to monitor networks for abnormal activity, using tools that log all traffic and endpoint detection and response software that can spot suspicious lateral connections. Other steps include blocking unknown or untrusted origins from reaching internal remote services, reviewing systems for new, inactive, or unrecognized accounts, disabling unused ports, and adding banners to emails from outside the organization.
Earlier this month, CISA, FBI, the National Security Agency (NSA) and international partners warned that Chinese government-linked threat actors are combining automated scanning, large-scale botnets and hands-on hacking techniques to infiltrate networks and steal sensitive data from organizations worldwide. The joint advisory said Integrity Technology Group, a China-based, for-profit company with links to the Chinese government, enables these hackers to exploit networks of U.S. and foreign organizations across multiple sectors.
