INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FBI and CISA Warn SafePay Ransomware Attacks on 600 Orgs

| 2026-10-22 06:48 HIGH HIGH RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
The SafePay ransomware group has been attacking at least 600 organizations across critical infrastructure sectors in North America, South America, Europe, and Australia since August 2024. The attackers are attributed to a joint advisory published by the FBI, CISA, US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies. SafePay uses stolen credentials, VPN access, and double extortion tactics to pressure victims into paying, with preferred entry points including exposed credentials, brute force password attacks, and VPN access. The attackers rely on common tools such as PsExec, WinRM, RDP, and PowerShell to move between systems, while also using Mimikatz to steal credentials and AnyDesk and TeamViewer for remote access. As of the advisory's publication in October 2026, SafePay remains an active threat, with its activity continuing despite the decline of other major ransomware groups such as BlackCat and LockBit.
Technical Mitigations AI-generated
• Implement the recommended mitigations from the advisory, including patching Cisco VPN flaws and using a Veeam vulnerability fix. • Block or hunt for unusual login attempts coming from Mullvad VPN IP addresses to detect SafePay threat actor initial access. • Use tools such as PsExec, WinRM, RDP, and PowerShell to monitor network activity and identify potential SafePay ransomware attacks.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
BlackCatBlackCat
Target & Sectors
NORTH_AMERICA NORTH_AMERICA DACH DACH LATAM LATAM
Incident Timeline
‎August 2024
Threat actors using the SafePay ransomware group have breached at least 600 organizations across multiple critical infrastructure sectors since August 2024.
victims 600 Organizations SafePay
The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia.
The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.”
target_region Australia
The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia.
“Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia.
target_region EUROPE
The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia.
“Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia.
target_region LATAM
The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia.
“Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia.
target_region NORTH_AMERICA
The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia.
“Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia.
tactic Ransomware
“Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia.
organisation LockBit
SafePay grew as groups such as BlackCat and LockBit declined, and its activity has continued.
‎mid-2024
SafePay ransomware group emerged in mid-2024 as an independent entity targeting organizations.
tactic Ransomware
SafePay appeared in mid-2024 as an independent ransomware group that operates without affiliates.
‎August 2026
Threat actors used SafePay ransomware to target 600 organizations, exploiting vulnerabilities in VPN access and using tools like PsExec, WinRM, RDP, and PowerShell to move between systems.
target_region United States
The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026.
target_region Germany
The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026.
attribution FBI
The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026.
organisation US Secret Service
The advisory includes findings from FBI, US Secret Service, and German investigations through August 2026.
organisation SecurityAffairs
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, ransomware)
organisation USSS
“The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [ TA0001 ] to organizations through various means, including credential exposure, implementing brute force password attacks [ T1110 ], and exploiting virtual private network (VPN) access.” states the advisory .
organisation AnyDesk
Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access.
organisation TeamViewer
Mimikatz is used to steal credentials, while AnyDesk and TeamViewer provide remote access.
infrastructure Windows
SafePay relies on legitimate Windows tools to move through compromised networks, making its activity harder to detect.
organisation SafePay’s
SafePay’s preferred entry points are exposed credentials, brute force password attacks, and VPN access.
organisation IP
“SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products” Security teams should watch for unusual login attempts coming from Mullvad VPN IP addresses.
organisation SonicWall
These include Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability, and a SonicWall access control issue.
organisation PsExec
They use PsExec, WinRM, RDP, and PowerShell to move between systems.
organisation RDP
They use PsExec, WinRM, RDP, and PowerShell to move between systems.
organisation FileZilla
To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive.
organisation RClone
To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive.
organisation OneDrive
To steal data, the group uses tools such as FileZilla, RClone, WinSCP, and even OneDrive.
organisation RSA
Encryption uses a ChaCha20 stream cipher combined with RSA for key exchange, with methods customized based on file type and size.
organisation TOR
“SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login.
After encryption, SafePay sends victims to a Tor-based chat portal for negotiations.
organisation MFA
Enable multi-factor authentication (MFA) for VPNs, webmail, and accounts that access critical systems.
organisation Limit
Limit the number of accounts allowed to use administrative tools.
organisation IOC
The advisory includes IOC files in STIX XML and JSON format, full MITRE ATT&CK mapping, and complete file and IP indicators.
‎2026/10/22
Threat actors using stolen credentials, VPN access, and double extortion tactics have hit over 600 organizations with SafePay ransomware attacks since at least 2024.
organisation SafePay
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay…
organisation the US Secret Service
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay…
victims 600 Organizations SafePay
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay…
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations.
organisation SafePay Ransomware Attacks
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations.
Tactical Metrics
Metrics
victims
600
Organizations Safepay
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay…
The group has breached at least 600 organizations across critical infrastructure sectors since August 2024, spanning North America, South America, Europe, and Australia.
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations.
The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.”
Metrics
infrastructure
‎Windows
Affected Product
SafePay relies on legitimate Windows tools to move through compromised networks, making its activity harder to detect.
Intelligence Sources
Security Affairs 2026-10-22