The US Cybersecurity and Infrastructure Security Agency has issued a joint advisory describing SafePay ransomware operations and urging organisations to strengthen their defences. The notice, released on 20 October, reports at least 600 victims in multiple critical infrastructure sectors since the group’s activity began in August 2024.
The advisory was prepared with the Federal Bureau of Investigation, the US Secret Service, authorities in Germany and law-enforcement bodies in the United Kingdom. It brings together observed methods, indicators of compromise and mitigation guidance for network defenders. The observations include investigations extending as recently as August 2026.
SafePay has affected organisations across North America, South America, Europe and Australia. The advisory characterises it as one of the most active ransomware groups in 2026. The reported total is a minimum count of separate victims; it does not provide a breakdown by country, sector or incident, and should not be read as a count of organisations in any one region.
The documented routes into networks include exposed or compromised credentials, brute-force password attempts and exploitation of vulnerabilities in internet-facing systems. The agencies also describe attackers using compromised profiles to access virtual private network services and exploiting weaknesses in edge devices. The advisory lists several vulnerability identifiers for products from multiple vendors, but it does not suggest that every affected system has been compromised.
After obtaining access, SafePay actors have been observed creating or taking over accounts, gaining administrative privileges and using legitimate system utilities to move between computers. Tools such as remote management software can be misused to execute commands across a network. Attackers have also searched file shares for valuable information, disabled security protections and, in some cases, changed user passwords in ways that prevent legitimate access.
The group’s activity may combine data theft with encryption. Investigators describe the use of common file compression and transfer tools to gather or remove data, followed by encryption of some or all files on affected systems. Encrypted files may carry a SafePay extension. Ransom notes demand cryptocurrency and threaten to publish stolen information. In some incidents, attackers have also been reported to contact victims directly. These are observed practices, not a guarantee that every attack follows the same sequence.
Because the intrusion can involve both stolen information and disruption to systems, restoring files alone may not address every consequence. Organisations should preserve relevant security records, assess whether information has left their network and follow established incident-response procedures. The advisory provides technical indicators intended to help defenders look for signs of activity, alongside recommendations to improve prevention and recovery.
Its practical guidance includes promptly applying security updates, especially to firewalls and other devices exposed at the network edge. It also recommends limiting administrative privileges and tools to users who need them, strengthening identity and access controls, and using multifactor authentication. A Zero Trust approach is among the measures highlighted. Organisations should review backup arrangements and recovery readiness as part of wider resilience planning.
The agencies’ notice is directed at public-sector bodies, critical infrastructure operators and other organisations responsible for defending networks. Its central message is that SafePay’s methods rely on a mix of credential abuse, vulnerable systems and legitimate administrative utilities, so prevention requires attention to account security as well as timely maintenance. The advisory gives defenders a consolidated set of technical details and response steps, while the scale of reported activity underlines the importance of preparing before an intrusion occurs.
