The Cybersecurity and Infrastructure Security Agency has released findings showing that the SafePay ransomware operation has successfully compromised in excess of 600 critical infrastructure organizations across the globe since August 2024. Working alongside the FBI, U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency and North West Regional Organised Crime Unit, CISA emphasized in its joint report that ransom payments offer no assurance of file recovery and encouraged affected organizations to notify law enforcement authorities.
SafePay is one of the most active ransomware groups and have affected businesses and critical infrastructure in North America, South America, Europe, and Australia—including at least 600 organizations from multiple critical infrastructure sectors since August 2024
CISA
Attack methods and initial access vectors
According to the advisory, SafePay operators employ multiple techniques to establish their initial foothold within target networks. The group leverages exposed credentials, password brute force campaigns, and unauthorized access to virtual private network infrastructure. Notably, the threat actors have demonstrated a pattern of targeting IP addresses associated with the VPN provider Mullvad.
SafePay threat actors gain initial access through a variety of means, including credential exposure, brute force password attacks, and exploiting virtual private network (VPN) access—particularly the IP addresses of VPN provider 'Mullvad'
CISA
Defensive recommendations
The collaborating agencies outlined several mitigation strategies for network defenders seeking to protect their infrastructure from SafePay operations. Organizations should prioritize restricting administrative tools and access privileges to prevent lateral movement once an attacker gains entry. Additionally, implementing multifactor authentication and establishing robust identity, credential, and access management frameworks strengthens account security posture.
Maintaining current system patches represents another critical control, with particular emphasis on addressing vulnerabilities in VPNs, firewalls, and edge devices. These systems frequently appear on CISA's list of actively exploited vulnerabilities and are commonly targeted by SafePay operators seeking network entry points.
They also use phished account profiles to infiltrate networks and exploit common vulnerabilities and exposures (CVEs) for edge devices and other internet-exposed systems through automated scripts
CISA
The advisory notes that SafePay actors may further impede recovery efforts by removing shadow copies and wiping network-attached storage devices that contain backup data.
Investigation findings and operational timeline
The guidance incorporates indicators of compromise and tactics, techniques, and procedures derived from investigations conducted between November 2024 and August 2026. These findings come from collaborative work by the FBI, U.S. Secret Service, and Landeskriminalamt Rheinland-Pfalz.
SafePay's operational model and market position
SafePay distinguishes itself from other ransomware operations by functioning as a private group that does not engage affiliate partners. The organization emerged in August 2024 and has since populated its dark web leak site with hundreds of victims spanning North America, South America, Europe, and Australia. However, the actual victim count exceeds the publicly listed organizations, as SafePay only displays those who declined to pay the ransom demand.
The group employs double-extortion methodology, exfiltrating sensitive data before encrypting systems and threatening to publish stolen information unless victims comply with ransom demands.
Since 2025 began, SafePay has progressively filled the operational void created by the decline of BlackCat (ALPHV) and LockBit ransomware, establishing itself as one of the most prolific ransomware actors currently operating.