US agencies identify 600 victims of SafePay ransomware

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a joint advisory with the FBI, US Secret Service, and law enforcement partners from Britain and Germany, warning that at least 600 organizations worldwide have been compromised by SafePay ransomware. This warning comes as SafePay is described as one of the most active ransomware groups of 2026.

The victims identified span across North America, South America, Europe, and Australia, though the report does not specify the distribution of these victims across critical infrastructure sectors or by country. The advisory provides technical indicators to assist security teams in detecting intrusions and mitigating damage. Brett Leatherman, assistant director of the FBI's Cyber Division, emphasized the need for businesses to enhance their network defenses.

SafePay operatives typically gain access to corporate networks through stolen or exposed credentials, password guessing, and vulnerabilities in internet-facing equipment. Phishing, automated exploitation of edge device weaknesses, and the use of VPN connections are also common tactics. Once inside, attackers aim to gain administrative privileges, often using legitimate management tools like PsExec and Windows Remote Management.

Before encrypting files, they typically collect sensitive data and transfer it to controlled infrastructure. SafePay follows a double-extortion strategy, threatening to publish stolen information if ransom demands are not met. Recovery can be challenging due to the deletion of Windows shadow copies and reset network-attached storage devices holding backups, which can leave organizations with limited recovery options.

Authorities recommend prioritizing patches for known exploited vulnerabilities, particularly those affecting firewalls, VPN equipment, and externally accessible devices. They also advise implementing multifactor authentication, strengthening identity management, and restricting administrative privileges. Maintaining offline, encrypted, and immutable backups, testing restoration procedures, and segmenting networks are additional recommended safeguards.