The SafePay ransomware group has compromised at least 600 organizations across multiple critical infrastructure sectors since August 2024, according to a new joint advisory from CISA, the FBI and international law enforcement agencies. Victims span North America, South America, Europe and Australia.
The advisory identifies SafePay as one of the most active ransomware groups in 2026.
Attackers gain access through stolen credentials, brute-force attacks, compromised VPN accounts and vulnerabilities in internet-facing devices, including firewalls.
Once inside networks, SafePay operators steal sensitive data, disable security protections and encrypt systems. Researchers also observed attackers deleting backup copies and resetting network-attached storage devices to disrupt recovery. The group threatens to publish stolen information if victims refuse to pay.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“SafePay hit at least 600 organizations without a single zero-day. The joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) lists five vulnerabilities used for initial access, the newest published in September 2024, the oldest patched more than six years ago. Six hundred critical infrastructure organizations had years of free scanner coverage and Known Exploited Vulnerabilities catalog entries for every one of these flaws, and still never got the window to apply them.
“The advisory’s own details show attackers know exactly which systems nobody wants to touch. Two of the five vulnerabilities target Veeam Backup & Replication, and SafePay pairs them with halting the Volume Shadow Copy Service and resetting network-attached storage to factory settings. A firewall reboot might break the plant floor. A backup server restart might void the recovery plan. So the boxes stay running for years on software with public exploit code, because an outage has a name attached to it and an unpatched vulnerability does not.
“That is a scheduling failure, and CISA’s mitigation list treats it as a homework assignment. Until critical infrastructure operators get a funded maintenance window and someone senior who owns the reboot decision, the next SafePay is already inside the perimeter everyone was too afraid to bounce.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“This particular attack is interesting for two pretty mundane reasons. First, they’re going after municipalities and critical infrastructure because, as we keep finding out, these organizations will pay. Look at how many people are affected when services go down. Add the political pressure to get those services restored, and attackers see a good chance of getting paid.
“Second, these are motherhood and apple pie exploitation techniques. We’re talking about advanced AI and exploits being developed incredibly quickly, while a huge number of organizations are still getting hit because of weak passwords and a lack of multifactor authentication.
“That’s what scares me more than the super elite hacks. It’s the standard stuff we still haven’t gotten under control as an industry.”
ㅤ
Josh Marpet, Senior Product Security Consultant, Finite State:
“It should come as no surprise that ransomware is a problem. After all thousands and tens of thousands of organizations have fallen victim to social engineering attacks, technical attacks, and business logic attacks. Wherever these ransomware groups can gain a foothold, they will use it to steal your current data, destroy your backups, and encrypt everything they can get their hot little hands on.
“And at the same time cyber insurance costs, if you include ransomware, are still incredibly high.
“So this group is using exploits that have been around since 2020. Let’s be clear on this, these are some six year old exploits. Oh wait, I’m sorry some of them are from 2024 only two years old.
“What happened to keeping on top of patching? Well, we have so much more software than we ever had before. How do we keep track of it all?
“We engage specialists. Software is built out of Legos. Libraries and functions. If we have a software bill of materials (SBOM), we can easily keep track of what’s there at what version, and if there’s any updates.
“Then updating it just becomes a matter of going down the list. But if you don’t have a software bill of materials, it’s much harder to keep track of a chaotic ever fluid morass.
“It’s 10pm, do you know what software you’re running?”
The fact is that everything needs be on the table. If it’s not, it will get pwned. It is that simple.
Related
This entry was posted on October 21, 2026 at 3:35 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
CISA, FBI warn SafePay ransomware has hit at least 600 critical infrastructure organizations
The SafePay ransomware group has compromised at least 600 organizations across multiple critical infrastructure sectors since August 2024, according to a new joint advisory from CISA, the FBI and international law enforcement agencies. Victims span North America, South America, Europe and Australia.
The advisory identifies SafePay as one of the most active ransomware groups in 2026.
Attackers gain access through stolen credentials, brute-force attacks, compromised VPN accounts and vulnerabilities in internet-facing devices, including firewalls.
Once inside networks, SafePay operators steal sensitive data, disable security protections and encrypt systems. Researchers also observed attackers deleting backup copies and resetting network-attached storage devices to disrupt recovery. The group threatens to publish stolen information if victims refuse to pay.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“SafePay hit at least 600 organizations without a single zero-day. The joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) lists five vulnerabilities used for initial access, the newest published in September 2024, the oldest patched more than six years ago. Six hundred critical infrastructure organizations had years of free scanner coverage and Known Exploited Vulnerabilities catalog entries for every one of these flaws, and still never got the window to apply them.
“The advisory’s own details show attackers know exactly which systems nobody wants to touch. Two of the five vulnerabilities target Veeam Backup & Replication, and SafePay pairs them with halting the Volume Shadow Copy Service and resetting network-attached storage to factory settings. A firewall reboot might break the plant floor. A backup server restart might void the recovery plan. So the boxes stay running for years on software with public exploit code, because an outage has a name attached to it and an unpatched vulnerability does not.
“That is a scheduling failure, and CISA’s mitigation list treats it as a homework assignment. Until critical infrastructure operators get a funded maintenance window and someone senior who owns the reboot decision, the next SafePay is already inside the perimeter everyone was too afraid to bounce.”
ㅤ
John Strand, Owner, Black Hills Information Security:
“This particular attack is interesting for two pretty mundane reasons. First, they’re going after municipalities and critical infrastructure because, as we keep finding out, these organizations will pay. Look at how many people are affected when services go down. Add the political pressure to get those services restored, and attackers see a good chance of getting paid.
“Second, these are motherhood and apple pie exploitation techniques. We’re talking about advanced AI and exploits being developed incredibly quickly, while a huge number of organizations are still getting hit because of weak passwords and a lack of multifactor authentication.
“That’s what scares me more than the super elite hacks. It’s the standard stuff we still haven’t gotten under control as an industry.”
ㅤ
Josh Marpet, Senior Product Security Consultant, Finite State:
“It should come as no surprise that ransomware is a problem. After all thousands and tens of thousands of organizations have fallen victim to social engineering attacks, technical attacks, and business logic attacks. Wherever these ransomware groups can gain a foothold, they will use it to steal your current data, destroy your backups, and encrypt everything they can get their hot little hands on.
“And at the same time cyber insurance costs, if you include ransomware, are still incredibly high.
“So this group is using exploits that have been around since 2020. Let’s be clear on this, these are some six year old exploits. Oh wait, I’m sorry some of them are from 2024 only two years old.
“What happened to keeping on top of patching? Well, we have so much more software than we ever had before. How do we keep track of it all?
“We engage specialists. Software is built out of Legos. Libraries and functions. If we have a software bill of materials (SBOM), we can easily keep track of what’s there at what version, and if there’s any updates.
“Then updating it just becomes a matter of going down the list. But if you don’t have a software bill of materials, it’s much harder to keep track of a chaotic ever fluid morass.
“It’s 10pm, do you know what software you’re running?”
The fact is that everything needs be on the table. If it’s not, it will get pwned. It is that simple.
Share this:
Like this:
Related
This entry was posted on October 21, 2026 at 3:35 pm and is filed under Commentary with tags CISA. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.