CISA and FBI Warn About SafePay: Ransomware Hit at Least 600 Organizations
CISA, the FBI and international partners issued a joint advisory on SafePay ransomware group activity. Since August 2024, they have identified at least 600 affected organizations.
SafePay ransomware has affected at least 600 separate victims since August 2024. This is according to a joint advisory issued October 20 by the U.S. agencies CISA, the FBI and the U.S. Secret Service, together with partners from Germany and the United Kingdom. The victims include organizations from multiple critical infrastructure sectors in North and South America, Europe and Australia.
Authorities also warn that the figure of 600 represents the minimum number of identified victims, not the complete global total. The advisory does not say that all affected organizations belong to critical infrastructure.
SafePay ransomware: main intrusion paths
According to the advisory, the group primarily gains initial access through stolen or guessed passwords, phishing campaigns, VPN access and the exploitation of vulnerabilities in systems exposed to the internet.
The risk of a ransomware incident includes data theft, system encryption and disruption of backup recovery. The joint warning provides network administrators with technical indicators of compromise that they can use when reviewing their own environments.
Recommended measures for administrators
CISA and partner agencies recommend promptly patching internet-facing edge devices. Other measures listed include deploying multifactor authentication (MFA) and limiting the use of administrative tools.
- Review the indicators of compromise published in the advisory.
- Update VPNs, firewalls and other devices at the network perimeter.
- Require MFA for remote and administrative access.
- Limit administrative tools to essential accounts and use cases.
What to watch next
Authorities may publish additional technical details, new indicators of compromise or information about actions against the group. Any security advisories from VPN, firewall and backup system vendors, as well as confirmed incidents forensically linked to SafePay, will also be relevant.
The public advisory does not confirm that the group is currently exploiting a specific new unpatched vulnerability. Organizations should therefore treat the technical indicators and recommendations as a basis for checking existing exposure, not as an announcement of one specific flaw.
Sources
- CISA – SafePay joint advisory announcement – Confirms the issuance of the joint advisory on October 20, 2026, at least 600 victims since August 2024, the main entry vectors and recommended mitigations.
- FBI IC3 – Industry Alerts – Confirms that the #StopRansomware: SafePay Ransomware advisory was listed among FBI IC3 alerts on October 20, 2026.
- The Record – Independently summarizes the joint advisory’s findings and the context of the techniques used.
Verified and updated: October 21, 2026, 15:28
