The SafePay ransomware group has compromised at least 600 critical infrastructure organizations worldwide, a joint advisory from US, German and UK government agencies warns.
Scale and recent activity: 600 victims and a spike in 2026
The advisory, published by the US Cybersecurity and Infrastructure Security Agency (CISA) on October 20, reports that SafePay has affected a range of businesses and critical infrastructure across North America, South America, Europe and Australia since the group emerged in August 2024. Independent industry reporting cited in the advisory underscores the group's high tempo in 2026: a BlacKite report published in June 2026 found SafePay to be the third most active ransomware group in the first four months of 2026, with a focus on Germany, while NCC Group identified SafePay as the most active group in May 2026 with 70 claimed attacks.
Initial access methods and on-network behavior used by SafePay
The advisory details SafePay’s broad range of initial access techniques: credential exposure, brute force password attacks, exploitation of virtual private network (VPN) access, and exploitation of vulnerabilities in edge device products. Once inside, attackers seek administrative privileges on existing or newly created accounts and move laterally using built-in administrative tools — a living-off-the-land approach that uses PsExec, WinRM and remote management and monitoring (RMM) software. Remote Desktop Protocol (RDP) has also been observed as a technique to expand presence within networks.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageData theft, double extortion and victim pressure
SafePay conducts data exfiltration to attacker-controlled accounts using legitimate file-transfer and archiving utilities, including FileZilla, OneDrive, 7-Zip, RClone and WinRAR. After exfiltration the group deploys a hybrid encryption scheme that combines a ChaCha20 stream cipher with an RSA public-key cryptosystem to lock victim files.
The actors employ a double extortion model. Victims receive ransom notes left on desktops or in root directories that instruct them to reach out over a TOR .onion chat portal using a provided victim ID. Ransom demands are typically framed as a subset of company revenue payable in cryptocurrency. The advisory also highlights an aggressive pressure tactic: a group representative will phone victims directly. Organizations that refuse to pay are threatened with publication of exfiltrated data on SafePay’s leak site, a link to which is included in the original note.
Attribution notes and a notable victim settlement
The advisory notes belief among analysts that SafePay may be a rebrand of several previously known ransomware groups — specifically LockBit, ALPHV/BlackCat and INC Ransomware. The group is also linked to a high-profile intrusion: SafePay is believed to be behind the November 2024 ransomware attack on US business services firm Conduent, an incident that saw a substantial amount of personal and healthcare data exfiltrated. On October 16, 2026, Conduent agreed to pay $80m to settle a class action lawsuit related to that breach.
Practical mitigations CISA and partners advise
- Prioritize remediation of known exploited vulnerabilities (KEVs) and keep operating systems, software and firmware up to date.
- Implement identity, credential, and access management (ICAM) policies and require multi-factor authentication (MFA) for all accounts.
- Maintain offline, encrypted and immutable backups; regularly test backup and restoration processes; and keep multiple copies of sensitive data in physically separate, segmented and secure locations.
- Segment networks to limit ransomware spread and identify, detect and investigate abnormal activity with network monitoring tools.
What this means for security teams, affected enterprises, and regulators
- Security teams — must prioritize KEV remediation, enforce MFA and monitor for the living‑off‑the‑land behaviors named in the advisory (PsExec, WinRM, RMM, RDP), and validate backup immutability and restore procedures.
- Affected enterprises — will need to plan for both operational continuity and potential legal exposure; the Conduent settlement illustrates the financial and data‑protection consequences linked to large-scale exfiltration.
- Regulators and government agencies — will be watching the uptake of recommended mitigations and may use the advisory’s specifics to inform guidance, oversight, or incident response support to targeted critical infrastructure sectors.
SafePay’s combination of high activity in 2026, diverse access techniques and a double‑extortion model that includes direct phone pressure makes it a clear immediate risk to organizations that provide or support critical infrastructure. The advisory’s checklist is straightforward: patch known exploited vulnerabilities, harden identity and access, and make sure backups are isolated, immutable and tested. The follow-through — whether organizations actually close these gaps at scale — will determine how many of the advisory’s 600 victims become many more.
