SafePay Ransomware Group Compromises Over 600 Critical Infrastructure Organizations
The ongoing threat of cybercrime has reached alarming proportions with the emergence of the SafePay ransomware group, which has reportedly compromised at least 600 critical infrastructure organizations globally. A collaborative advisory issued by government agencies from the United States, Germany, and the United Kingdom underscores the significant impact of SafePay’s operations since its arrival on the cyber landscape in August 2024.
The advisory, prepared by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), warns about the group’s wide-ranging influence across various sectors and geographical regions—including North America, South America, Europe, and Australia. The alarming report details the extensive techniques employed by SafePay to gain initial access to networks and conduct post-compromise activities. It stresses the urgent need for security teams to fortify their defenses against this rising threat.
Since its inception, SafePay has been classified as one of the most active ransomware groups of 2026, demonstrating an alarming capability to launch attacks across multiple sectors. A report from BlacKite published in June 2026 revealed that the group ranked as the third most active ransomware entity within the first four months of the year, marking Germany as one of its primary targets. Complementing these findings, the NCC Group also reported SafePay as the most active ransomware group in May 2026, with 70 confirmed attacks throughout the month.
There’s speculation in cybersecurity circles that SafePay may represent an amalgamation of several notorious ransomware groups, such as LockBit, ALPHV/BlackCat, and INC Ransomware. Compounding concerns, SafePay is believed to be responsible for a major ransomware attack on the U.S. business services firm Conduent in November 2024, which resulted in significant exfiltration of personal and healthcare data. Conduent has since agreed to pay $80 million to settle a class-action lawsuit related to this data breach, reflecting the profound financial consequences of inaction against such groups.
A Closer Look at SafePay’s Techniques
Published on October 20, the advisory elaborates on the varied initial access techniques employed by SafePay. These tactics include, but are not limited to, credential exposure, brute force password attacks, vulnerabilities in virtual private networks (VPNs), and exploitations of weaknesses in edge device products. Once inside a network, SafePay attackers strive for administrative privileges, allowing them to traverse and hook into sensitive systems and data.
Utilizing built-in administrative tools consistent with “living off the land” (LOTL) techniques, such as PsExec and WinRM, SafePay’s operatives effectively maneuver through compromised networks. They further extend their control employing remote desktop protocol (RDP), strategically disabling security measures to minimize the chances of detection. Additionally, reports indicate that the group leverages software packing and virtual machine software protection to obscure their code from scrutiny.
When it comes to data exfiltration, SafePay uses legitimate file transfer tools such as FileZilla and OneDrive, making it challenging for organizations to detect unauthorized activity. After exfiltrating sensitive data, the attackers deploy a sophisticated hybrid encryption scheme that incorporates a ChaCha20 stream cipher along with an RSA public-key cryptosystem to lock victim files.
Pressuring Victims: The Double-Edged Sword of Extortion
SafePay employs a double extortion model that amplifies the stakes for its victims. Typically, they deposit a ransom note on the victim’s system, usually located on the desktop or within the root directory, instructing them to reach out through a specific chat portal. This portal, accessible via a TOR .onion link, requires victims to log in using a unique victim ID. The ransom typically demanded amounts to a percentage of the organization’s revenue, and payments are requested in cryptocurrency.
To further pressure victims, SafePay representatives often resort to direct phone calls, emphasizing the urgency of compliance with the ransom demands. In cases where organizations resist payment, SafePay takes the drastic step of posting the stolen data on its leak website, as indicated in their initial ransom note.
Recommendations for Protection and Mitigation
In light of the rising threat posed by SafePay, the advisory outlines a series of action items designed for organizations to bolster their cybersecurity posture. Key recommendations include:
- Prioritizing the remediation of known exploited vulnerabilities (KEVs) while ensuring that all operating systems and software are regularly updated.
- Implementing robust identity, credential, and access management (ICAM) policies across the organization, mandating multifactor authentication (MFA) for all accounts.
- Maintaining offline backups of data and routinely testing backup and restoration processes.
- Ensuring that all backup data is encrypted, immutable, and comprehensive, covering the organization’s entire data architecture.
- Establishing a recovery plan that guarantees multiple copies of sensitive data are securely stored in a physically separated and well-segmented environment.
- Segmenting networks to prevent the lateral movement of ransomware.
- Utilizing network monitoring tools to identify, detect, and investigate abnormal activities and potential ransomware traversal.
The landscape of cybersecurity is continually evolving, and the rise of groups like SafePay highlights the pressing need for organizations to be vigilant and proactive in their defense strategies.