The SafePay ransomware group has hit at least 600 victims since it surfaced in August 2024, and its methods are aimed squarely at the remote-access logins and backup systems that most organizations rely on to survive an attack, U.S., German and British agencies said in a joint advisory Tuesday published by the Cybersecurity and Infrastructure Security Agency (CISA).
What Happened
The advisory, "#StopRansomware: SafePay Ransomware" (AA26-293A), was written by the FBI, CISA, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz (a state criminal police office), the UK National Crime Agency and the UK's North West Regional Organised Crime Unit. It says SafePay has affected "at least 600 separate victims" from multiple critical infrastructure sectors, without naming them, along with businesses in North America, South America, Europe and Australia. The agencies call SafePay "among the most active ransomware groups in 2026." Its technical indicators cover activity from November 2024 to August 2026, and the advisory does not link the group to any country.
According to the agencies, SafePay gets in through exposed or guessed passwords, brute-force login attempts, phished accounts and abused virtual private network (VPN) access, including connections from addresses belonging to the commercial Mullvad VPN service. It also runs automated scripts against five known flaws. The advisory lists them by number only; public CVE records show that CVE-2020-3259 and CVE-2023-20269 affect Cisco's ASA and Firepower Threat Defense firewall software, CVE-2023-27532 and CVE-2024-40711 affect Veeam Backup & Replication, and CVE-2024-40766 affects SonicWall's SonicOS firewall software.
Once inside, the operators take over or create administrator accounts, move between machines with standard Windows tools such as PsExec, WinRM and Remote Desktop, steal passwords with Mimikatz, switch off security software and change users' passwords to lock staff out. They install remote-support programs such as AnyDesk and TeamViewer, then copy data out with RClone, WinSCP, FileZilla and, in some cases, OneDrive or Backblaze's upload tool. Before encrypting, they stop Windows' Volume Shadow Copy Service, which keeps restore points, and reset network-attached storage that holds backups to factory settings; in some cases, all network-attached backups were deleted. Encrypted files get a ".SafePay" extension.
The ransom is typically "a subset of company revenue in cryptocurrency," the advisory says. A representative phones victims to add pressure, and data from those who refuse to pay is posted to a leak site.
Why It Matters
SafePay does not need novel techniques. All five flaws were disclosed between 2020 and 2024, and much of the intrusion relies on weak passwords and legitimate administration software. The group's focus on backups means an organization whose recovery plan depends on storage reachable from the main network may find that plan erased first. And because data is stolen before encryption, restoring systems does not end the extortion threat.
The visible toll is likely understated. BleepingComputer reported that SafePay lists only victims that refuse to pay, and that the group, which works without outside affiliates, has filled the gap left by the LockBit and BlackCat operations since early 2025. The Record reported that SafePay has claimed attacks on UK technology firm Microlise and government contractor Conduent; Infosecurity Magazine said SafePay is believed to be behind Conduent's November 2024 attack. Conduent agreed Oct. 16 to an $80 million class-action settlement over its breach, which still needs court approval, The Primary Wire reported, citing a securities filing. The advisory itself names no victims.
What Leaders Should Ask
The agencies' mitigations translate into a short list of questions for security teams. Are flaws in CISA's Known Exploited Vulnerabilities catalog on internet-facing systems patched first, using the framework in Binding Operational Directive 26-04? Is multifactor authentication enforced on webmail, VPNs and critical-system accounts? Are passwords at least 15 characters, without forced changes more than once a year? Are backups offline, encrypted, immutable, kept in separate locations and tested? The advisory also calls for network segmentation, endpoint detection and response tools, audits for unrecognized accounts on domain controllers and servers, and just-in-time access for administrators.
What to Watch
The agencies ask victims to report attacks to the FBI's Internet Crime Complaint Center, a Secret Service field office or CISA, and they discourage paying ransoms, noting that payment does not guarantee recovery. The advisory announces no arrests or infrastructure takedowns, so any follow-on action by the German and British units involved would be the next signal. Also watch edge devices more broadly: Palo Alto Networks' Unit 42 reported this week that other ransomware groups are exploiting a GlobalProtect VPN flaw, another edge-device route ransomware crews are using.
