The Cybersecurity and Infrastructure Security Agency and partner law-enforcement agencies said SafePay ransomware has affected at least 600 organizations across multiple critical-infrastructure sectors since August 2024, spanning North America, South America, Europe and Australia.
In its report on the SafePay activity, BleepingComputer reported that the joint advisory was issued by CISA, the FBI, the U.S. Secret Service and law-enforcement agencies in Germany and the United Kingdom. The agencies said SafePay operators gain access through exposed credentials, brute-force password attacks, phishing and VPN access, including activity involving Mullvad IP addresses.
The advisory’s defensive guidance includes restricting administrative tools and privileges to limit lateral movement, implementing multifactor authentication and identity, credential and access-management policies, and prioritizing updates for VPNs, firewalls and other edge devices listed in CISA’s Known Exploited Vulnerabilities catalog. The report also includes indicators of compromise and tactics, techniques and procedures from investigations covering SafePay activity observed between November 2024 and August 2026.
The agencies warned that SafePay can delete shadow copies and reset network-attached-storage devices containing backups, potentially complicating recovery. They also said paying a ransom does not guarantee that encrypted files will be recovered and urged victims to report incidents to law enforcement.
An earlier Acronis Threat Research Unit analysis of SafePay samples documented RDP- and VPN-based intrusion, credential theft, privilege escalation, disabling endpoint protection, data exfiltration and shadow-copy deletion. That analysis is technical background rather than independent confirmation of the new victim count.
The fetched reporting does not identify specific CVE numbers or affected product versions for the edge-device exploitation described by the agencies. Organizations should use the linked advisory’s IOCs and TTPs, alongside CISA’s actively exploited vulnerabilities catalog, to check exposed systems and accounts.