The FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and law enforcement agencies from the United States, the United Kingdom, and Germany have issued a joint cybersecurity advisory warning organizations about the growing threat posed by SafePay ransomware.
According to the advisory, the ransomware group has affected at least 600 victims since August 2024, targeting organizations across multiple regions and critical infrastructure sectors. Authorities describe SafePay as one of the most active ransomware groups in 2026, highlighting the continued risks it poses to businesses and essential services. Source: The Record
The warning is a reminder that ransomware remains a serious cybersecurity challenge, particularly for organizations that rely on internet-facing systems, remote access technologies, and networked infrastructure.
SafePay Ransomware: What Businesses Need to Know
SafePay is a ransomware operation that compromises computer networks, disrupts business operations, and threatens organizations with the loss of access to their data.
The joint advisory was issued by the FBI, CISA, the U.S. Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency, and the North West Regional Organised Crime Unit.
The agencies compiled technical information from investigations into SafePay incidents to help security teams better understand how the group operates and how they can reduce the risk of an attack.
Since emerging in August 2024, SafePay has reportedly affected organizations across North America, South America, Europe, and Australia. Its victims span multiple sectors, including critical infrastructure.
The scale of the reported attacks has prompted authorities to share information about the group’s methods and recommend practical steps organizations can take to strengthen their defenses. Source: FBI and CISA advisory listing
How SafePay Ransomware Attacks Organizations
One of the key concerns raised in the advisory is that SafePay can take advantage of weaknesses that organizations could have addressed through stronger security practices.
According to reporting on the advisory, the group uses several methods to gain access to victim networks, including stolen credentials, phishing, and exploitation of known software vulnerabilities.
1. Stolen passwords and compromised accounts
Weak passwords, reused credentials, and compromised accounts can give attackers an opportunity to enter corporate networks without immediately triggering security alerts.
Once inside, SafePay operators may establish control by creating new accounts or taking over existing ones. These actions can help them maintain access and move toward their ultimate objectives.
Organizations should enforce multifactor authentication (MFA), particularly for administrator accounts, remote access services, and other systems that could provide broad network access.
2. Exploiting unpatched vulnerabilities
SafePay has also been associated with the exploitation of known vulnerabilities in enterprise software and network infrastructure.
The joint advisory identifies vulnerabilities observed during investigations, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
These findings underline the importance of keeping VPN appliances, backup infrastructure, operating systems, and other internet-facing services up to date.
Security teams should review the full official advisory to determine whether their systems are affected by the specific vulnerabilities listed and prioritize remediation accordingly.
3. Phishing and other initial-access methods
Phishing remains another route through which ransomware operators can compromise organizations.
A convincing email, malicious link, or deceptive attachment may trick an employee into revealing login credentials or launching harmful content.
Regular security awareness training, effective email filtering, and strong identity protections can reduce the likelihood that a single mistake will lead to a wider network compromise.
What Happens After SafePay Gains Access?
Ransomware incidents can escalate quickly once attackers establish a foothold in a network.
Threat actors may attempt to expand their access, compromise additional accounts, identify valuable files, and interfere with security or recovery systems. They may then encrypt data and demand payment to restore access.
The resulting disruption can affect more than IT operations. Organizations may experience service outages, delayed business activities, financial losses, and potential exposure of sensitive information.
For companies operating critical infrastructure, these consequences can be particularly serious because interruptions may affect essential services and connected organizations.
The exact sequence of events can vary from one incident to another, so businesses should use the indicators of compromise and technical details in the joint advisory to guide their investigations.
How Organizations Can Protect Against SafePay Ransomware
The international warning provides an opportunity for organizations to review their security controls before an incident occurs.
The following measures can help reduce ransomware risk:
Apply security patches promptly. Identify vulnerable systems and prioritize updates for internet-facing applications, VPN devices, and other technologies named in the advisory.
Enable multifactor authentication. Require MFA for remote access, privileged accounts, and important business applications wherever possible.
Strengthen password security. Use unique passwords, a business password manager, and centralized identity controls to reduce the risk of compromised credentials being reused.
Secure backups. Maintain regular backups of important data and keep protected copies offline or isolated from the main network. Test restoration procedures to ensure the organization can recover when needed.
Monitor network activity. Look for unusual account creation, suspicious authentication attempts, unexpected privilege changes, and activity that may indicate unauthorized access.
Restrict administrative privileges. Give employees and service accounts only the access they need. Separate privileged accounts from everyday user accounts.
Prepare an incident response plan. Establish clear procedures for isolating affected systems, contacting security teams, preserving evidence, and notifying relevant authorities.
Organizations should also review the official SafePay advisory for its complete technical indicators, recommended mitigations, and details of the vulnerabilities observed in investigations.
Why the SafePay Warning Matters
The SafePay advisory highlights a persistent problem for businesses: ransomware groups do not always need sophisticated new techniques to compromise vulnerable organizations.
Unpatched systems, stolen credentials, and gaps in network security can create opportunities for attackers, even when organizations have already invested in cybersecurity tools.
The involvement of law enforcement agencies from the United States, the United Kingdom, and Germany also demonstrates the importance of international cooperation in responding to ransomware operations that affect victims across borders.
For security teams, the immediate priority should be to determine whether their systems are exposed to the techniques and vulnerabilities identified in the advisory and address any weaknesses without delay.
Final Thoughts
The FBI, CISA, and their international partners are warning organizations not to underestimate the SafePay ransomware threat. With at least 600 reported victims since August 2024, the group remains a significant concern for businesses and critical infrastructure operators.
Organizations can reduce their exposure by patching vulnerable systems, securing accounts, protecting backups, and monitoring their networks for suspicious activity.
Rather than waiting for an attack to reveal weaknesses, businesses should use the advisory to review their defenses and strengthen their ability to prevent, detect, and recover from ransomware incidents.
Official resource: Organizations can consult the FBI’s Internet Crime Complaint Center industry alerts for the SafePay advisory and related cybersecurity guidance.