CISA Says SafePay Ransomware Has Hit More Than 600 Critical Infrastructure Organizations
Summary
CISA and partner agencies say SafePay has affected at least 600 critical infrastructure organizations since August 2024. Their advisory describes access methods and urges MFA, restricted privileges, timely patching, and incident reporting.
Key points
- A joint advisory from CISA, the FBI, USSS, and European and UK agencies says SafePay affected at least 600 organizations across multiple critical infrastructure sectors since August 2024.
- The agencies say SafePay gains access through exposed credentials, brute-force attacks, VPN access, phishing, and exploitation of flaws in internet-exposed systems.
- The advisory recommends MFA, stronger identity and access management, restricting administrative tools and privileges, and patching vulnerabilities in VPNs, firewalls, and other edge devices.
- CISA says SafePay may disrupt recovery by deleting shadow copies and resetting network-attached storage containing backups.
- The advisory includes indicators of compromise and tactics, techniques, and procedures observed in investigations from November 2024 through August 2026.
- The article says SafePay uses double extortion, stealing documents before encrypting systems and threatening to publish stolen data.
Article Details
- Event Type
- Government advisory reporting widespread SafePay ransomware activity against critical infrastructure organizations.
- Impact
- CISA reports that SafePay has affected more than 600 organizations across multiple critical infrastructure sectors worldwide since August 2024. Agencies describe credential exposure, brute-force attacks, exploitation of VPN access and edge-device vulnerabilities, and phishing as access methods. The group steals sensitive documents before encrypting systems and may delete shadow copies or reset network-attached storage containing backups. Paying a ransom does not guarantee file recovery.
MITRE ATT&CK
T1078 · Valid AccountsThe article says attackers use valid credentials after obtaining them.T1110 · Brute ForceCISA reports that SafePay uses brute-force password attacks for initial access.T1486 · Data Encrypted for ImpactSafePay encrypts victims' systems in ransomware attacks.T1490 · Inhibit System RecoverySafePay actors may delete shadow copies and reset network-attached storage devices containing backups to disrupt recovery.T1566 · PhishingCISA reports that SafePay uses phishing to infiltrate networks.T1567 · Exfiltration Over Web ServiceThe group steals sensitive documents and threatens to leak them online if victims do not pay.