The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024.

In a joint report with the FBI, the U.S. Secret Service (USSS), Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency and North West Regional Organised Crime Unit, the federal agency added that paying ransoms does not guarantee recovery of files encrypted in ransomware attacks and urged victims to report incidents to law enforcement.

"SafePay is one of the most active ransomware groups and have affected businesses and critical infrastructure in North America, South America, Europe, and Australia—including at least 600 organizations from multiple critical infrastructure sectors since August 2024," CISA said.

"SafePay threat actors gain initial access through a variety of means, including credential exposure, brute force password attacks, and exploiting virtual private network (VPN) access—particularly the IP addresses of VPN provider 'Mullvad'."

The co-authoring agencies advised network defenders to secure their networks against the ransomware group's attacks by restricting administrative tools and privileges to block lateral movement after compromise and implementing multifactor authentication (MFA) and identity, credential, and access management (ICAM) policies for better account security.

Security teams should also keep systems updated, focusing on flaws affecting VPNs, firewalls, and other edge devices added to CISA's catalog of actively exploited vulnerabilities because they're often targeted in SafePay attacks for initial access to victims' networks.

"They also use phished account profiles to infiltrate networks and exploit common vulnerabilities and exposures (CVEs) for edge devices and other internet-exposed systems through automated scripts," CISA added. "SafePay actors may disrupt recovery operations by deleting shadow copies and resetting network-attached storage devices containing backups."

The advisory also includes indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) to previous SafePay ransomware activity observed between November 2024 and August 2026 during FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations.

Unlike similar operations, ​SafePay emerged in August 2024 as a private ransomware group that doesn't work with affiliates. 

It has since added hundreds of victims from North America, South America, Europe, and Australia to its dark web leak site, but the actual number of victims it has breached and attempted to extort is higher, since it lists only those who don't pay on its leak platform.

This ransomware group is also known for double-extortion tactics, stealing sensitive documents before encrypting the victims' systems and threatening to leak all the stolen data online if a ransom isn't paid.

Since the start of 2025, SafePay has slowly filled the gap left by BlackCat (ALPHV) and LockBit ransomware, becoming one of the most active ransomware operations.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report