SafePay ransomware gang hits at least 600 organizations worldwide
SafePay steals your data, locks your files, and then sends you the bill.
Getty Images For Unsplash.
Follow us
- CISA says SafePay ransomware has breached at least 600 organizations across critical infrastructure sectors worldwide.
- SafePay steals data before locking files, then threatens to publish stolen information if victims do not pay.
- Attackers use stolen logins, phishing, exposed systems, and common remote access tools to move through networks.
- Agencies urge organizations to patch systems, use multi-factor authentication, monitor networks, and avoid paying ransoms.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The Cybersecurity and Infrastructure Security Agency (CISA) claims that the SafePay ransomware extortion gang has breached at least 600 companies and organizations from multiple critical infrastructure sectors.
In a joint report with the FBI, the United States Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency (NCA), and the United Kingdom’s North West Regional Organized Crime Unit, the agency says that the ransomware extortion group has been attacking hundreds of businesses and critical infrastructure companies across North America, South America, Europe, and Australia.
SafePay is a double-extortion ransomware operation that was first observed in August 2024. The group operates by using exposed or stolen login credentials, brute-force attacks, phishing, and vulnerabilities in internet-connected systems, such as VPNs, firewalls, routers, and other edge devices.
Once the group has gained access, they explore the victim’s internal network. The attackers leverage legitimate tools used by their victims to blend in with normal network activity, such as AnyDesk, FileZilla, PowerShell, RClone, ScreenConnect, TeamViewer, and WinRAR.
Before deploying ransomware, the attackers collect and exfiltrate sensitive data from their victim’s network. Once all relevant information is in, the victim’s internal systems are encrypted.
To regain access, the victim needs to obtain the decryption key. The attackers will hand over the key only if the targeted organization pays a hefty ransom. If they refuse, SafePay threatens to publicly release all the stolen data on the dark web.
Researchers have linked SafePay to cyberattacks on several high-profile businesses, including Microlise, Ingram Micro, and, more recently, Deutsche Telekom’s subsidiary T-Systems.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
“SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors,” CISA says in its joint Cybersecurity Advisory.
To protect their business from SafePay cyberattacks, organizations should remediate known exploited vulnerabilities, keep operating systems and other software up to date, implement identity, credential, and access management (ICAM), enable multi-factor authentication (MFA), segment networks, and monitor network traffic for suspicious activity.
The agencies recommend not paying the ransom demand because it doesn’t guarantee that the stolen files will be recovered. On top of that, paying encourages other threat actors to distribute malware and fund their illicit activities.
