GoKawiilCISA says SafePay ransomware has breached over 600 critical infrastructure organizations
CISA, the FBI, the US Secret Service, and law enforcement agencies in Germany and the UK issued a joint advisory stating the SafePay ransomware gang has compromised more than 600 critical infrastructure organizations across North America, South America, Europe and Australia since August 2024. The agencies said SafePay actors gain access through credential theft, brute-force attacks, and VPN exploitation, particularly targeting Mullvad VPN IP addresses, and often delete shadow copies and reset network-attached storage to hinder recovery.
GoKawiil's interpretation of the reporting above, not reported fact.
The scale of the campaign, spanning multiple continents and sectors, suggests SafePay has become one of the more prolific ransomware operations tracked by Western law enforcement. The advisory's emphasis that paying ransoms doesn't guarantee data recovery could push more victims toward reporting incidents and investing in preventive defenses like MFA and patching edge devices rather than negotiating with attackers.
- SafePay has hit over 600 critical infrastructure organizations globally since August 2024
- Attackers exploit VPNs, stolen credentials, and brute-force methods for initial access, notably via Mullvad VPN IPs
- CISA urges MFA, access controls, and prompt patching of edge devices to defend against the group
YubiKey 5 NFC Security Key — With ransomware gangs like SafePay breaking in via stolen credentials and brute-forced VPN logins, hardware-based multi-factor authentication is one of the strongest defenses available. A YubiKey adds a physical layer of verification that's extremely difficult for attackers to bypass remotely, making it a smart investment for anyone managing sensitive accounts or networks.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-21
Published there as: “CISA: SafePay ransomware hit over 600 critical infrastructure orgs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.