At Least 600 Victims and No Affiliates: A Profile of SafePay, the Ransomware Crew Now Flagged by the FBI and CISA
U.S., German and British agencies have published a joint warning about SafePay, a ransomware group they say has hit at least 600 organizations since August 2024. Here is the group’s profile, entry by entry, with the countermeasure that answers each one.
Federal agencies do not issue a dedicated ransomware advisory for every gang. When the FBI, CISA, the U.S. Secret Service and police agencies from Germany and the United Kingdom sign a joint document about one group, it is worth reading as a field guide. On Tuesday they did exactly that for SafePay.
We built the profile below from BleepingComputer’s report on the advisory, CISA’s advisory AA26-293A itself and coverage by The Record.
The profile
Active since
August 2024. The agencies call SafePay one of the most active ransomware groups of 2026, with at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe and Australia. Because the group only lists victims that refuse to pay on its leak site, BleepingComputer notes the real number of organizations it has hit is higher.
Business model
Unusually, SafePay runs as a closed operation and does not rent its ransomware to affiliates. It steals data before encrypting systems, then threatens to publish what it took. The advisory says the ransom demand is pegged to a slice of the victim’s revenue, paid in cryptocurrency.
Answer: assume a breach means both an outage and a data leak, and plan for both in your incident response and insurance conversations.
Ways in
- Stolen or exposed credentials, and passwords guessed through brute force.
- Phishing to take over accounts.
- Abuse of VPN access, with the agencies singling out connections from IP addresses of the commercial VPN service Mullvad.
- Automated scanning for known flaws in VPNs, firewalls and other internet-facing systems. The advisory lists five CVEs, among them CVE-2023-27532, a flaw in Veeam backup software.
Answer: multifactor sign-in on every remote access path, fast patching of edge devices (starting with anything on CISA’s Known Exploited Vulnerabilities list), and a review of whether your VPN should accept logins from anonymizing VPN services at all.
Behavior once inside
According to the advisory, SafePay creates new accounts or hijacks existing ones, moves around using legitimate system tools, hunts for valuable files and switches off security protections. In some cases it changes users’ passwords to lock them out. It compresses and exfiltrates data with ordinary tools and has used legitimate remote desktop software such as AnyDesk and TeamViewer to drop the ransomware onto machines.
Answer: limit administrative tools and privileges to the people who need them, alert on new admin accounts, and decide which remote support tools are allowed so that any other one stands out.
Attacks on recovery
The agencies warn that SafePay may delete Windows shadow copies and reset network-attached storage devices that hold backups.
Answer: keep at least one backup copy offline or immutable, on credentials the domain does not control, and test a restore.
Pressure tactics
A group representative may phone the victim to push for payment. The agencies also stress that paying does not guarantee files come back, and they ask victims to report incidents to law enforcement.
Recent claims
The Record reports that SafePay has claimed attacks on British tech company Microlise and on government contractor Conduent, whose ransomware incident disrupted services tied to Medicaid, child support, food assistance and tolls. Conduent announced an $80 million class action settlement last week.
What this means for your company
Nothing in SafePay’s playbook is exotic. It wins with reused passwords, unpatched VPNs and firewalls, and backups the attacker can reach. That is good news for a small or mid-size business, because each of those is fixable this quarter. Use the advisory as a checklist: confirm multifactor sign-in on remote access and email, check your firewall and VPN firmware against the KEV list, inventory remote access tools, and prove you can restore from a backup the network cannot delete. Contractors who serve government or critical infrastructure customers should expect those customers to ask about exactly these controls.
Need help checking your remote access, patching and backups against the SafePay advisory? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
