SafePay Ransomware Hits Over 600 Critical Infrastructure Sites Worldwide

The Cybersecurity and Infrastructure Security Agency (CISA) has revealed that the SafePay ransomware gang has breached more than 600 critical infrastructure organizations worldwide since August 2024.

The disclosure was made in a joint advisory issued alongside the FBI, the U.S. Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency, and the North West Regional Organised Crime Unit. Participating agencies warned that paying ransom demands does not guarantee the recovery of encrypted files.

According to the threat intelligence findings, SafePay actors gain initial access to target networks through a variety of attack vectors. These include credential exposure, brute-force password attacks, and the exploitation of virtual private network (VPN) access—notably targeting IP addresses associated with the Mullvad VPN provider. Attackers also rely on phished account profiles and automated scripts to exploit known vulnerabilities in edge devices and internet-exposed systems.

Operating as a private ransomware group without affiliate partnerships since August 2024, SafePay has targeted entities across North America, South America, Europe, and Australia. The group employs double-extortion tactics, exfiltrating sensitive documents before encrypting victim systems and threatening to publish stolen data on its dark web leak platform if extortion demands are ignored.

To disrupt recovery operations after an intrusion, SafePay actors routinely delete shadow copies and reset network-attached storage devices that contain backups.

Co-authoring agencies advised network defenders to secure environments by restricting administrative tools and privileges to block lateral movement. Security teams should also implement multi-factor authentication and robust identity, credential, and access management policies while keeping edge devices patched against actively exploited vulnerabilities.