SafePay ransomware group targets 600 victims across critical infrastructure sectors

1. Executive summary

CISA, the FBI, the US Secret Service and international partners issued a joint advisory on SafePay, a ransomware group they describe as one of the most active in 2026, with approximately 600 victims across the Americas, Europe and Australia. SafePay gains access by compromising credentials and exploiting known vulnerabilities in internet-facing devices, frequently reaching them through VPN services, then uses legitimate IT tools to move laterally, deletes or disables backups, steals data and encrypts systems. Extortion combines the threat to publish stolen data with, in some cases, direct telephone calls to victims. No CVE, CVSS score, EPSS value or CISA KEV entry is attached to SafePay in the public advisory, and the group has no MITRE ATT&CK profile, so the attribution and the technical detail below rest on the joint advisory alone. For EMEA financial services the exposure is concentrated in internet-facing VPN and edge infrastructure with weak credential controls, and in backup estates that a single set of domain credentials can reach.

2. Regulatory framing

3. Technical analysis & attack chain

The joint advisory describes the following sequence. Each step is stated at the level of generality the advisory uses; it does not name specific products, versions, CVEs or tools.

1. Credential compromise. SafePay actors obtain valid credentials for the victim network.
2. Exploitation of known vulnerabilities in internet-facing devices, with VPN services named as the common connection path into the network.
3. Lateral movement using legitimate IT tools already present in the environment (living-off-the-land), rather than bespoke malware.
4. Destruction of recovery capability: backups are deleted or disabled.
5. Data theft, followed by encryption of systems.
6. Extortion: victims are pressured with the threat to publish stolen information, and in some cases actors call victims directly.

The advisory does not identify which vulnerabilities were exploited, which VPN products were targeted, which legitimate tools were used for lateral movement, or what ransomware payload was deployed. It provides no file names, hashes, command lines, registry keys, scheduled-task names or command-and-control addresses in the public release. The full joint advisory (#StopRansomware: SafePay Ransomware) is referenced as carrying the observed TTPs and IOCs, but those are not reproduced in the public announcement summarised here. Defenders should obtain the full advisory for the technical indicators.

Two features of the described method carry the most defensive weight. First, access is credential-led and edge-facing: the entry point is a login, not a phishing attachment, so MFA coverage on VPN and remote-access services and prompt patching of internet-facing devices are the controls that interrupt step 1 and step 2. Second, backup destruction precedes encryption, which means the recovery capability is a target in its own right and must be isolated from the credentials used for day-to-day administration.

Attribution caveat: SafePay has no MITRE ATT&CK profile, and the advisory does not attribute the group to a state or to a known tracked cluster. Treat the actor identity as unconfirmed. The victim count (approximately 600) and the sector spread are stated by the issuing agencies and are not independently corroborated in the material reviewed here.

4. Mitigation & containment

P1 within 24h

• Enforce MFA on every VPN and remote-access service that terminates into the corporate network. The advisory names VPN services as the common connection path, so any VPN endpoint without MFA is the priority gap.
• Inventory internet-facing devices and confirm their patch state against the vendor's current advisories. The advisory urges prioritising known exploited vulnerabilities on internet-facing systems; where a device cannot be patched immediately, restrict its exposure at the firewall to known source ranges.
• Verify that backups are offline or immutable and that the credentials used to delete them are not the same credentials used for routine administration. Test a restoration now, not at incident time. The advisory specifically recommends maintaining offline backups and regularly testing restoration.

P2 within 72h

• Segment the network so that a compromised credential on one segment cannot reach backup infrastructure or the core transaction estate. The advisory recommends segmentation to prevent ransomware spread.
• Review authentication logs on VPN and edge devices for logins from unusual geographies, off-hours access, or a single account authenticating from multiple locations, consistent with the credential-compromise entry described.
• Hunt for use of legitimate remote-management and IT administration tools running outside their normal baseline, since the advisory states actors use legitimate IT tools to move through networks.

P3 within 7 days

• Keep operating systems, software and firmware current across the estate, per the advisory's standing recommendation.
• Brief service-desk and incident-response staff on the callback extortion pattern (actors telephoning victims) so that unsolicited calls pressuring for payment are routed to the incident team and verified against known contacts rather than acted on.

5. Indicators of compromise

No indicators of compromise available in the source material. The public advisory names no hashes, domains, IP addresses, file paths or command lines; it states that IOCs are contained in the full joint advisory, which is not reproduced here. Do not treat the absence of indicators as evidence the actor leaves none; obtain the full #StopRansomware: SafePay advisory before building detection content.

6. Detection

Insufficient indicators to author detection rules. The source provides no distinctive strings, command-line flags, file names, registry keys or network artefacts specific to SafePay. Detection should instead target the behaviours the advisory describes (anomalous VPN authentication, off-baseline use of legitimate IT tools, deletion or disabling of backup jobs), which are generic to many ransomware operators and are better covered by environment-specific analytics than by a rule attributed to this group.

7. Sources

• CISA, FBI, USSS and international partners, "CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors", https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-safepay-ransomware-actors-targeting-multiple-critical, 2026-10-21. (Primary item; single source for all SafePay facts in this advisory.)
• The Record (Recorded Future), "More than 200 victims of Medusa ransomware identified over the last year, CISA says", https://therecord.media/more-than-200-medusa-ransomware-victims-last-year-cisa. (Context only; concerns Medusa, not SafePay.)
• CISA, "CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide", https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat. (Context only; unrelated actor.)
• Help Net Security, "Medusa ransomware gang has hit over 500 organizations, CISA warns", https://www.helpnetsecurity.com/2026/08/19/medusa-ransomware-cisa-warning/, 2026-08-19. (Context only; concerns Medusa, not SafePay.)

8. Adverse Trace position

Adverse Trace assesses SafePay as a credential-led, edge-facing ransomware operation whose defining risk to EMEA financial clients is the combination of VPN and internet-facing device exposure with pre-encryption destruction of backups; the severity of any individual intrusion cannot be scored from this advisory because it carries no CVE, CVSS or KEV data, and the actor has no MITRE ATT&CK profile, so attribution remains unconfirmed. The approximately 600-victim figure and the sector spread are single-sourced to the issuing agencies and should be read as their assessment, not an independently verified count. Client impact is highest for firms with VPN endpoints lacking MFA, internet-facing devices behind on patching, and backup estates reachable with routine administrative credentials. We will obtain the full #StopRansomware: SafePay advisory to extract the TTPs and IOCs this public release omits, and will issue a follow-up with atomic indicators and detection content once those are available; until then, clients should treat the P1 controls in section 4 as the actionable set.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.