The **Cybersecurity and Infrastructure Security Agency (CISA)**, in collaboration with the **FBI**, the **U.S. Secret Service (USSS)**, Germany's **Landeskriminalamt Rheinland-Pfalz**, and the UK's **National Crime Agency** and **North West Regional Organised Crime Unit**, has issued a stark warning regarding the **SafePay** ransomware group. ### Global Reach and Impact **SafePay** has emerged as one of the most prolific ransomware threats, impacting businesses and critical infrastructure across North America, South America, Europe, and Australia. Since August 2024, the group has breached at least 600 organizations, with the actual number of victims likely higher as their dark web leak site only lists those who refuse to pay. ### Initial Access Vectors **SafePay** actors employ a diverse array of methods to gain initial access. These include credential exposure, brute-force password attacks, and exploiting vulnerabilities in Virtual Private Network (VPN) access, notably targeting the IP addresses of the VPN provider **Mullvad**. They also leverage phished account profiles and exploit common vulnerabilities and exposures (**CVEs**) in edge devices and internet-exposed systems through automated scripts. ### Disruptive Tactics Beyond encryption, **SafePay** is known for its double-extortion tactics, exfiltrating sensitive data before encrypting systems and threatening public disclosure if a ransom is not paid. The group also actively disrupts recovery operations by deleting shadow copies and resetting network-attached storage devices containing backups. ### Recommendations for Network Defenders To counter **SafePay**'s sophisticated attacks, the co-authoring agencies advise network defenders to implement several key security measures: * **Restrict Administrative Privileges:** Limit administrative tools and privileges to prevent lateral movement post-compromise. * **Implement MFA and ICAM:** Enforce multifactor authentication (**MFA**) and robust identity, credential, and access management (**ICAM**) policies for enhanced account security. * **Timely System Updates:** Prioritize patching systems, especially those affecting VPNs, firewalls, and other edge devices, which are frequently targeted for initial access. Organizations should pay close attention to flaws listed in **CISA**'s catalog of actively exploited vulnerabilities. ### Indicators of Compromise (IOCs) and TTPs The advisory provides detailed indicators of compromise (**IOCs**) and tactics, techniques, and procedures (**TTPs**) observed in **SafePay** ransomware activity between November 2024 and August 2026, gathered during ongoing investigations by the **FBI**, **USSS**, and **Landeskriminalamt Rheinland-Pfalz**. ### A Rising Threat Unlike many ransomware-as-a-service operations, **SafePay** operates as a private ransomware group, eschewing affiliates. Since early 2025, it has increasingly filled the void left by other prominent groups like **BlackCat (ALPHV)** and **LockBit**, solidifying its position as one of the most active ransomware operations globally.  ### The Blue Report 2026 Further insights into post-initial access attacker behavior are available in The Blue Report 2026. This report measures defenses technique by technique across 338 million simulations, revealing that only 37% of attacker actions are blocked once valid credentials are obtained.