CISA says SafePay hit more than 600 critical infrastructure organisations

The SafePay ransomware group has breached more than 600 critical infrastructure organisations worldwide since August 2024, according to a new joint advisory from the US Cybersecurity and Infrastructure Security Agency, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz and the UK’s National Crime Agency and North West Regional Organised Crime Unit.¹

What the advisory says

CISA describes SafePay as one of the most active ransomware operations currently targeting businesses and critical infrastructure across North America, South America, Europe and Australia. The agencies say the group typically gains initial access through stolen or guessed passwords, phishing and vulnerabilities in internet-facing security products, including VPNs, firewalls and other edge devices.¹

Once inside a network, SafePay actors can create or take over accounts, use legitimate administration tools to move laterally and disable security protections. The advisory says the attackers then encrypt files and demand cryptocurrency, while also using double-extortion tactics: sensitive documents are stolen before encryption and victims are threatened with publication if they refuse to pay.¹²

CISA and its partners specifically warn that paying a ransom does not guarantee recovery. The advisory includes indicators of compromise, technical details about the group’s tactics and techniques, and references to activity observed during investigations between November 2024 and August 2026.¹

How organisations can reduce the risk

The agencies recommend regularly patching and updating systems, particularly firewalls and other edge devices. They also call for multifactor authentication and identity, credential and access-management policies, a Zero Trust approach, and tighter controls on administrative tools and privileges.¹

CISA’s report lists several vulnerabilities associated with the group’s activity, including flaws affecting VPN and firewall products. Security teams should compare their exposed systems with CISA’s Known Exploited Vulnerabilities catalogue and review the advisory’s indicators of compromise rather than relying on the headline victim count alone.¹

BleepingComputer reports that the 600-organisation figure covers victims across multiple critical-infrastructure sectors and notes that the true number of attempted compromises may be higher because leak sites generally list organisations that refuse to pay.²

Our opinion

The useful part of this advisory is not the shock value of a large number. It is the reminder that ransomware resilience is mostly unglamorous security hygiene: patch the edge, protect accounts, restrict administrative power and keep recovery systems out of reach. SafePay’s scale makes the warning harder to dismiss, but the recommended actions are the same ones organisations should already be practising.