Cybersecurity
CISA says SafePay hit 600 critical infrastructure organisations
CISA and partner agencies said SafePay had breached more than 600 critical infrastructure organisations since 2024 and outlined how the group gained access, maintained pressure and disrupted recovery.
- CISA said SafePay had breached more than 600 critical infrastructure organisations worldwide since 2024.
- The advisory appeared in a joint report with the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit.
- The agencies said paying a ransom did not guarantee file recovery and urged victims to report incidents to law enforcement.
- CISA said SafePay had used exposed credentials, brute-force password attacks and VPN access, including IP addresses linked to Mullvad.
- The report said SafePay emerged in August 2024 as a private ransomware group without affiliates and used double extortion and a leak site.
CISA said SafePay had breached more than 600 critical infrastructure organisations worldwide since 2024. It issued that assessment in a joint report with the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit.
The agencies said victims should not assume that paying a ransom would restore encrypted files, and they urged reporting to law enforcement. They also said defenders should reduce administrative access, use multifactor authentication and identity and access controls, and keep VPNs, firewalls and other edge devices patched.
The report said SafePay gained entry through exposed credentials, password-guessing attacks and VPN access, particularly via IP addresses tied to Mullvad. It also said the group used phished account profiles and exploited common vulnerabilities in internet-exposed systems with automated scripts.
CISA said the group could interfere with recovery by deleting shadow copies and resetting network-attached storage devices that held backups. The advisory said its indicators of compromise and tactics, techniques and procedures drew on investigations carried out between November 2024 and August 2026.
The report said SafePay emerged in August 2024 as a private ransomware group that did not use affiliates. It also said the group had used double extortion and listed only victims that did not pay on its leak site.
Named in this story
Companies
- Mullvad
- was cited in connection with VPN IP addresses used for access
Organisations
- SafePay
- the ransomware group described in the advisory
- BlackCat (ALPHV)
- was named as a ransomware operation SafePay had helped replace
- LockBit
- was named as a ransomware operation SafePay had helped replace
Governments and agencies
- Cybersecurity and Infrastructure Security Agency (CISA)
- issued the assessment and advisory
- FBI
- co-authored the report and investigations
- U.S. Secret Service (USSS)
- co-authored the report and investigations
- Germany's Landeskriminalamt Rheinland-Pfalz
- co-authored the report and investigations
- UK's National Crime Agency
- co-authored the report
- North West Regional Organised Crime Unit
- co-authored the report
How the source tells it
The article was a straight CISA advisory summary with a cautious, warning-led register rather than overt hype.
- urgency the repeated defensive instructions and reporting advice framed the piece as immediate guidance
- threat emphasis a large victim count was paired with a superlative description of the group