CISA: SafePay ransomware hit over 600 critical infrastructure orgs

SafePay ransomware has compromised more than 600 critical infrastructure organizations globally since August 2024. The group gains initial access through credential exposure, brute force password attacks, exploitation of VPN access (notably targeting Mullvad VPN IPs), and phishing. They leverage automated scripts to exploit known vulnerabilities in edge devices and internet-exposed systems. SafePay employs double-extortion by exfiltrating sensitive data prior to encrypting victims' systems and threatening public leaks. They also hinder recovery efforts by deleting shadow copies and resetting network-attached storage backups. Unlike affiliate-based ransomware groups, SafePay operates as a private group and has become one of the most active ransomware threats since 2025, filling the void left by BlackCat and LockBit. CISA and allied agencies advise securing networks with multifactor authentication, restricting administrative privileges, and timely patching of VPNs, firewalls, and other edge devices to mitigate risk.

SafePay ransomware has caused widespread disruption to critical infrastructure organizations across multiple continents. The group's double-extortion tactics increase the risk of sensitive data exposure in addition to system encryption. Their ability to delete shadow copies and reset backup devices complicates recovery efforts, potentially leading to prolonged operational downtime and data loss. The broad range of initial access methods and exploitation of common vulnerabilities in edge devices increases the attack surface for organizations. The large number of victims and ongoing activity indicate a significant threat to critical infrastructure security.

CISA and partner agencies recommend implementing multifactor authentication (MFA) and robust identity, credential, and access management (ICAM) policies to improve account security. Restrict administrative tools and privileges to prevent lateral movement after compromise. Keep systems updated, focusing on patching vulnerabilities in VPNs, firewalls, and other edge devices that are commonly targeted by SafePay. Monitor for indicators of compromise (IOCs) and apply recommended tactics, techniques, and procedures (TTPs) from official advisories. Reporting incidents to law enforcement is advised. No official patch or fix exists for SafePay ransomware itself, as it is a threat actor rather than a software vulnerability.