GoKawiilCISA says SafePay ransomware has breached over 600 critical infrastructure organizations
CISA, the FBI, the US Secret Service, and law enforcement agencies in Germany and the UK issued a joint advisory stating the SafePay ransomware gang has compromised more than 600 critical infrastructure organizations across North America, South America, Europe and Australia since August 2024. The agencies said SafePay actors gain access through credential theft, brute-force attacks, and VPN exploitation, particularly targeting Mullvad VPN IP addresses, and often delete shadow copies and reset network-attached storage to hinder recovery.