CISA and FBI Warn SafePay Ransomware Has Hit Over 600 Critical Infrastructure Organizations
The US Cybersecurity and Infrastructure Security Agency (CISA), the FBI and partner agencies in Germany and the United Kingdom published a joint advisory on 20 October 2026 describing the SafePay ransomware operation. According to the agencies, the group has compromised at least 600 critical infrastructure organizations in North America, South America, Europe and Australia since it emerged in August 2024.
The advisory describes a typical intrusion chain. SafePay affiliates gain initial access through exposed or stolen credentials, brute-force attacks, abuse of VPN access and exploitation of vulnerabilities in edge devices. They then seek administrator rights and move laterally using built-in tools such as PsExec, WinRM and RDP, as well as remote monitoring and management software. Data is exfiltrated with legitimate utilities including RClone, FileZilla and WinRAR before files are encrypted with a hybrid ChaCha20 and RSA scheme. Victims are pressured under a double-extortion model: a Tor chat portal for negotiations, ransom demands tied to a share of company revenue, phone calls to staff and a leak site for stolen data.
Industry trackers cited by Infosecurity Magazine ranked SafePay among the most active groups in 2026, with a particular focus on Germany, and some researchers suspect it is a rebrand of an older ransomware brand. The group has been linked to the 2024 attack on Conduent, which this month led to an $80 million class-action settlement. Infosecurity Magazine and eSecurity Planet also reported on the advisory. The agencies urge organizations to patch known exploited vulnerabilities, enforce multi-factor authentication, maintain tested offline and immutable backups, segment networks and monitor for lateral movement.