CISA says SafePay breached over 600 critical infrastructure organizations

CISA says SafePay ransomware has breached over 600 critical infrastructure organizations worldwide since 2024. A joint advisory with U.S., German and UK law enforcement agencies includes indicators of compromise and attack techniques observed during investigations between November 2024 and August 2026. The group gains access through exposed credentials, brute force password attacks and vulnerable internet-facing systems. It steals documents before encrypting systems and may disrupt recovery by deleting shadow copies and resetting storage devices containing backups. The agencies recommend restricting administrative privileges, enabling multifactor authentication and patching vulnerable edge devices; paying a ransom does not guarantee file recovery.