A joint advisory from CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz and two UK law-enforcement agencies says SafePay ransomware has affected at least 600 organisations in critical infrastructure sectors since August 2024. Victims span North America, South America, Europe and Australia. The agencies describe SafePay as one of the most active ransomware groups in 2026; their findings draw on investigations up to August 2026.
The attackers gain access through exposed or stolen credentials, brute-force password attacks and VPN access. The advisory says they have used Mullvad VPN IP addresses and exploited known vulnerabilities in internet-facing devices, including Cisco VPN products, a Veeam product and a SonicWall access-control issue. Inside networks, they use tools such as PsExec, WinRM, RDP and PowerShell to move between systems, steal credentials and locate data.
SafePay steals data before encrypting files, then threatens to publish it if victims do not pay. Encryption uses ChaCha20 with RSA for key exchange, and affected files receive the `.SafePay` extension. The group also targets backups, including by deleting Volume Shadow Copies and resetting network-attached backup devices. The advisory says files cannot be recovered without the decryption key; payment does not guarantee recovery.
The agencies recommend updating internet-facing devices, prioritising flaws listed in CISA’s Known Exploited Vulnerabilities catalogue, and enabling multi-factor authentication for VPNs, webmail and critical accounts. They also advise restricting administrative access and command-line tools, and keeping backups offline, encrypted and immutable. The advisory includes technical indicators of compromise in STIX XML and JSON formats.