"SafePay is one of the most active ransomware groups and have affected businesses and critical infrastructure in North America, South America, Europe, and Australia—including at least 600 organizations from multiple critical infrastructure sectors since August 2024," CISA said.
SafePay's scale and how the tally likely understates impact
The Cybersecurity and Infrastructure Security Agency (CISA), in a joint advisory with the FBI, the U.S. Secret Service (USSS), Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency and North West Regional Organised Crime Unit, reported that SafePay has breached more than 600 critical infrastructure organizations worldwide since August 2024. The advisory notes the dark web leak site maintained by SafePay contains hundreds of victims from North America, South America, Europe, and Australia, but that the group posts only those victims who refuse to pay; the actual number of breached and extorted organizations is therefore higher than the publicly listed figure.
Initial access: credential exposure, brute force, and Mullvad VPN IPs
The co-authoring agencies say SafePay gains initial access through several routes. Specifically cited are credential exposure, brute force password attacks, and exploitation of virtual private network (VPN) access — with the advisory identifying the IP addresses of VPN provider "Mullvad" as a particular vector. The report also describes the use of phished account profiles and automated scripts to exploit common vulnerabilities and exposures (CVEs) in edge devices and internet-exposed systems.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDouble-extortion and disruption of recovery operations
SafePay operates as a private ransomware group that, unlike affiliate-based models, does not work with affiliates, the advisory says. The group is known for double-extortion tactics: stealing sensitive documents before encrypting systems and threatening to publish stolen data if victims do not pay. The agencies further warn SafePay actors may actively disrupt recovery by deleting shadow copies and resetting network-attached storage devices that contain backups — steps that hinder restoration even if an organization has backups in place.
Observed activity, indicators, and the investigative window
The advisory contains indicators of compromise (IOCs) and documents tactics, techniques, and procedures (TTPs) tied to SafePay activity observed during FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations. The reported observations span attacks recorded between November 2024 and August 2026. The agencies emphasize that paying a ransom does not guarantee recovery of encrypted files and urge victims to report incidents to law enforcement.
Recommended mitigations from CISA, FBI, USSS, Germany's Landeskriminalamt, and UK agencies
To blunt SafePay's techniques and limit lateral movement after compromise, the co-authoring agencies recommend that network defenders restrict administrative tools and privileges. They advise implementing multifactor authentication (MFA) and identity, credential, and access management (ICAM) policies to harden account security. Security teams should keep systems updated, with particular attention to flaws affecting VPNs, firewalls, and other edge devices that appear on CISA's catalog of actively exploited vulnerabilities. The advisory also points defenders to the included IOCs and TTPs to help detect and respond to SafePay activity.
What this means for network defenders, policymakers, and affected enterprises
- Network defenders and security teams: Expect the advisory's emphasis on MFA, ICAM, and restricted administrative privileges to guide near-term defensive priorities; the report highlights edge devices, VPNs, and exposed systems as the most targeted entry points.
- Policymakers and law enforcement partners: The multi-agency nature of the advisory — CISA together with the FBI, USSS, Landeskriminalamt Rheinland-Pfalz, and UK agencies — underscores cross-border investigative coordination and the continued push to route victims toward reporting incidents to law enforcement rather than resolve incidents solely through payment.
- Affected enterprises and procurement leaders: The advisory signals that visible leak-site counts understate total breaches and that resilience planning must account for attackers who both encrypt systems and sabotage backups. Vendor attention to patching VPNs, firewalls, and other edge devices will be an immediate procurement and operational focus.
The advisory also situates SafePay in the recent ransomware landscape: since the start of 2025, SafePay has "slowly filled the gap left by BlackCat (ALPHV) and LockBit ransomware," becoming one of the most active operations. The agencies warn that technical prevention metrics can mask a crucial gap — "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." That observation is echoed in the Blue Report 2026, which measures defenses technique by technique across 338 million simulations run in customer production environments.
SafePay's combination of precise initial-access methods, theft prior to encryption, and active interference with recovery means defenders face a consolidated threat: an operation focused on speed, data theft, and destruction of backups. Organizations targeted across critical infrastructure sectors will likely need to prioritize credential hygiene, edge-device patching, and law enforcement engagement to reduce both the frequency of breaches and the cost of recovery.
