Agencies warn SafePay compromised over 600 critical infrastructure organizations

SafePay ransomware has compromised over 600 critical infrastructure organizations across the Americas, Europe and Australia, CPO Magazine reported, citing a joint advisory from CISA and partner agencies. The advisory details attack methods and indicators that defenders can use to identify intrusions. Attackers gain access through compromised credentials, VPNs and known vulnerabilities, then use legitimate administrative tools to move through networks and steal data. They also delete shadow copies and reset storage devices containing backups. Agencies recommend patching edge devices, restricting administrative privileges and implementing multifactor authentication. The FBI warns that ransom payments do not guarantee file recovery.