The SafePay ransomware group has compromised more than 600 organizations across multiple critical infrastructure sectors worldwide since August 2024, according to a joint cybersecurity advisory from CISA and international law enforcement partners.
The campaign has affected organizations across North America, South America, Europe, and Australia, making SafePay one of the most active ransomware operations currently targeting enterprise and critical infrastructure environments.
SafePay Ransomware Targets Critical Infrastructure
The advisory was issued jointly by the Cybersecurity and Infrastructure Security Agency (CISA), FBI, U.S. Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency, and the North West Regional Organised Crime Unit.
Authorities warned that paying a ransom does not guarantee successful data recovery and urged affected organizations to report incidents to law enforcement.
SafePay has targeted organizations through several initial-access methods, including:
- Exposed or compromised credentials.
- Brute-force password attacks.
- Phished user accounts.
- Exploitation of vulnerable VPN infrastructure.
- Automated exploitation of internet-facing systems and edge devices.
CISA also noted that SafePay activity has involved VPN-related infrastructure associated with Mullvad IP addresses during some intrusions.
Vulnerable VPNs and Edge Devices Remain Key Entry Points
SafePay operators frequently target weaknesses in VPN appliances, firewalls, and other perimeter devices, particularly vulnerabilities already listed in CISA’s Known Exploited Vulnerabilities (KEV) Catalog.
These systems are attractive targets because successful exploitation can provide attackers with direct access to internal enterprise networks without requiring malware delivery through email or endpoints.
Once inside, SafePay operators attempt to expand access, move laterally, and gain control over high-value systems before deploying ransomware.
SafePay Uses Double-Extortion Tactics
SafePay follows a double-extortion model, combining encryption with data theft.
Before encrypting systems, attackers steal sensitive corporate information and then threaten to publish the stolen data if the victim refuses to pay.
This approach increases pressure on affected organizations because even companies with reliable backups still face:
- Exposure of confidential documents.
- Regulatory and compliance risks.
- Reputational damage.
- Potential leakage of customer or employee data.
SafePay maintains a dark web leak site where non-paying victims are publicly listed. However, the true number of compromised organizations is likely higher because victims that pay are typically not included.
Attackers Attempt to Disrupt Recovery
SafePay operators are also known to target recovery mechanisms after gaining access.
According to the advisory, attackers may:
- Delete Windows shadow copies.
- Reset network-attached storage systems.
- Destroy or disable accessible backups.
- Restrict administrative recovery options.
These techniques are designed to make restoration more difficult and increase pressure on victims to negotiate.
How Organizations Can Defend Against SafePay
CISA and its partners recommend that organizations prioritize controls that limit both initial access and lateral movement.
Key defensive measures include:
- Enforcing multifactor authentication (MFA) on privileged and remote-access accounts.
- Strengthening identity, credential, and access management (ICAM) policies.
- Restricting administrative privileges and remote management tools.
- Applying security updates rapidly to VPNs, firewalls, and internet-facing systems.
- Prioritizing vulnerabilities listed in CISA’s KEV Catalog.
- Segmenting critical infrastructure and backup environments.
- Maintaining offline or otherwise isolated backups.
- Monitoring authentication activity for brute-force and credential-abuse patterns.
Organizations should also integrate SafePay indicators of compromise (IOCs) and MITRE ATT&CK-aligned tactics, techniques, and procedures (TTPs) into SIEM, EDR, and threat-hunting workflows.
SafePay Becomes a Major Ransomware Operation
SafePay emerged in August 2024 as a private ransomware operation rather than a traditional ransomware-as-a-service group that relies on external affiliates.
Since 2025, its activity has increased significantly, helping fill part of the ransomware ecosystem left by the disruption or decline of major groups such as BlackCat/ALPHV and LockBit.
Its growing victim count, focus on critical infrastructure, aggressive double-extortion tactics, and attacks against recovery systems make SafePay a significant threat to organizations with exposed remote-access services and weak identity controls.
Leave a Reply