CriticalRansomware
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
BleepingComputer·Source published ·1 min read·Video available
Advisory videoOpen on YouTube ↗
What happened?
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]
Key details
- CISA reports SafePay ransomware has breached over 600 critical infrastructure organizations globally since August 2024.
- SafePay gains initial access via credential exposure, brute force, VPN exploitation, and phishing.
- Group uses double-extortion: steals data before encryption and threatens to leak it.
- SafePay operates as a private group without affiliates, unlike typical ransomware-as-a-service models.
- Advisory includes IOCs and TTPs from investigations between November 2024 and August 2026.
- Paying ransom does not guarantee file recovery; victims urged to report to law enforcement.
Affected
- Critical infrastructure organizations across multiple sectors worldwide.
- Organizations in North America, South America, Europe, and Australia.
Fixes and mitigations
- Restrict administrative tools and privileges to block lateral movement after compromise.
- Keep systems updated, focusing on flaws in VPNs, firewalls, and edge devices in CISA's exploited vulnerabilities catalog.
What to look for
- IOCs and TTPs from SafePay activity observed November 2024 through August 2026.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.