SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, | #ransomware | #cybercrime

The SafePay ransomware group has compromised at least 600 critical infrastructure organizations, according to a joint advisory issued by government agencies from the US, Germany and UK.

The authoring agencies, which includes the US Cybersecurity and Infrastructure Security Agency (CISA), warned that since emerging in August 2024, SafePay’s operations have affected a range of businesses and critical infrastructure in North America, South America, Europe and Australia.

The advisory highlighted SafePay’s extensive range of techniques for initial access and post-compromise activities. It urged security teams to take action to mitigate the specific threat posed by SafePay.

It also observed that the actor has been one of the most active ransomware groups in 2026.

A BlacKite report published in June 2026 found that the group was the third most active ransomware group in the first four months of 2026, with the actor focusing its efforts on Germany.

SafePay was also found to be the most active ransomware group in May 2026 by NCC Group, with 70 claimed attacks during the month.

It is believed that SafePay may be a rebrand of several other well-known groups – LockBit, ALPHV/BlackCat and INC Ransomware.

SafePay is believed to be behind the November 2024 ransomware attack on US business services firm Conduent, which resulted in a substantial amount of personal and healthcare data being exfiltrated. On October 16, 2026, Conduent agreed to pay $80m to settle a class action lawsuit related to the data breach.

Range of Initial Access Techniques

The advisory, published by CISA on October 20, highlighted SafePay’s extensive range of initial access vectors. These include credential exposure, implementing brute force password attacks, exploiting virtual private network (VPN) access and exploiting vulnerabilities in edge device products.

Once inside a network, SafePay attackers attempt to gain administrative privileges on existing or newly created accounts to move laterally and access sensitive systems and data. This approach involves using in-built administrative tools consistent with living off the land (LOTL) techniques, such as PsExec, WinRM and remote management and monitoring (RMM) software.

They also employ remote desktop protocol (RDP) to expand their presence within the compromised network.

SafePay actors typically disable security software to avoid detection, and have also been observed using software packing or virtual machine software protection to conceal their code.

To exfiltrate data from victim networks to attacker-controlled accounts, the threat actors use legitimate file transfer tools, such as FileZilla, OneDrive, 7-Zip, RClone and WinRAR.

Following exfiltration, SafePay actors lock victim files using sophisticated hybrid encryption scheme, which combines a ChaCha20 stream cipher with an RSA public-key cryptosystem.

Attackers Pressure Victims Using Phone Calls

The group deploys a double extortion model. It leaves a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal via a TOR .onion link with a victim ID as the login.

SafePay typically demands a subset of company revenue in cryptocurrency in exchange for decryption software.

A representative of the group will also phone victims to increase pressure to pay the extortion demand.

If the organization refuses to pay, SafePay posts the exfiltrated data to its leak website, which is linked in the original ransom note.

How to Protect Against SafePay Attacks

The advisory set out a range of recommendations for security teams to improve their organization’s resiliency to SafePay’s known tactics, techniques and procedures (TTPs). These include:

Prioritize remediating known exploited vulnerabilities (KEVs) and keep all operating systems, software, and firmware up to date

Implement identity, credential, and access management (ICAM) policies across the organization and require MFA for all accounts

Maintain offline backups of data and regularly test and maintain backup and restoration processes

Ensure all backup data is encrypted, immutable and covers the entire organization’s data infrastructure

Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented and secure location

Segment networks to prevent the spread of ransomware

Identify, detect and investigate abnormal activity and potential traversal of the indicated ransomware with a network monitoring tool

Click Here For The Original Source.

——————————————————–

…………

Related