SafePay Ransomware Has Breached More Than 600 Critical Infrastructure Organisations, Global Advisory Warns

One of the world’s most prolific ransomware operations has now breached more than 600 critical infrastructure organisations, according to a joint advisory issued on Tuesday by law enforcement and cybersecurity agencies in the United States, Germany and the United Kingdom. The warning targets SafePay, a group that has quietly become one of the most active ransomware actors anywhere since it emerged in August 2024.

The advisory — issued by the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the US Secret Service alongside Germany’s Landeskriminalamt Rheinland-Pfalz and the UK’s National Crime Agency and North West Regional Organised Crime Unit — urges victims to report incidents to law enforcement and repeats the official position that paying a ransom does not guarantee files will be recovered.

How SafePay gets in

Investigators say the group favours unglamorous but effective entry points: exposed credentials, brute-force password attacks, and weaknesses in VPN access — in particular addresses associated with the Mullvad VPN provider. Members also use phished account profiles and automated scripts that scan for known vulnerabilities in edge devices and internet-facing systems. Once inside a network, they practise double extortion, stealing sensitive data before encrypting systems and threatening to publish the haul on a dark-web leak site if the ransom goes unpaid.

The group is also accused of sabotaging recovery itself, deleting shadow copies and resetting network-attached storage devices that hold backups — a tactic designed to leave victims with no option but negotiation.

A private crew filling a vacuum

Unlike many ransomware brands, SafePay does not rent its tools to affiliates; it operates as a closed, private group. That discipline appears to have served it well. As older heavyweights such as BlackCat (ALPHV) and LockBit have declined under law-enforcement pressure, SafePay has expanded across North America, South America, Europe and Australia. The advisory’s core advice is defensive hygiene: protect credentials, harden VPN and edge devices, patch promptly, and keep backups isolated enough that an intruder cannot wipe them on the way out. For critical infrastructure operators, the figure of 600 breached organisations is the agencies’ way of saying the threat is no longer hypothetical.

Source: Zot News