FBI and CISA warn SafePay ransomware has hit at least 600 victims since 2024

US, German and British agencies have issued a joint advisory warning that the SafePay ransomware group has compromised at least 600 organizations since August 2024, making it one of the most active ransomware operations of 2026. The #StopRansomware advisory, AA26-293A, was released on October 20 by the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit.

What happened

According to the advisory, SafePay targets businesses and critical infrastructure in North America, South America, Europe and Australia. The Record reports that the guidance draws on FBI and German law enforcement investigations, with the most recent incident cited occurring in August. The Record also notes that experts have said parts of SafePay's code resemble LockBit, and that the group has claimed attacks on Ingram Micro, British tech company Microlise and government contractor Conduent.

Technical details

CISA says SafePay actors gain access through stolen or guessed passwords, brute-force attacks, phishing, exploited VPN access and unpatched internet-facing systems. The advisory lists CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766 among the flaws used for initial access. The Record adds that the group runs automated scripts to scan exposed systems.

Once inside, the operators create or take over accounts, move laterally with legitimate tools, disable security software and steal data. The advisory lists tools including PsExec, WinRM, PowerShell, ScreenConnect, AnyDesk, TeamViewer, Mimikatz, NetExec, 7-Zip, WinRAR, RClone and Backblaze's b2.exe, noting that these are legitimate programs and should not be treated as malicious without evidence of misuse.

To block recovery, SafePay stops the Volume Shadow Copy Service and resets network-attached storage backups to factory settings. Files are encrypted with a hybrid ChaCha20 and RSA scheme and given the .SafePay extension. According to The Record, the group demands a portion of company revenue in cryptocurrency, uses phone calls to pressure victims and posts stolen data on its leak site, and in some cases changes user passwords to lock out defenders.

Who is affected

The advisory says victims span multiple critical infrastructure sectors. The Record reports that the leak site lists dozens of German companies as well as government organizations in Latin America and the US.

What to do

• Prioritize patching known exploited vulnerabilities, particularly on VPNs and other internet-facing systems.
• Require MFA for VPNs, webmail and privileged accounts, and enforce long passwords with account lockout.
• Keep offline, encrypted and immutable backups, and regularly test restoration.
• Segment networks, filter access to remote services and disable unused ports.
• Use EDR and network monitoring to spot lateral movement, and audit Active Directory for new or unrecognized accounts.
• Apply least privilege and just-in-time access for administrator accounts.