CISA warns of SafePay ransomware targeting global critical infrastructure

The Cybersecurity and Infrastructure Security Agency reported on October 20, 2026, that the SafePay ransomware group has been highly active since August 2024. The group is targeting businesses and critical infrastructure sectors across North America, South America, Europe, and Australia. [1]

According to CISA Alerts, SafePay operators typically gain initial entry to target networks through several common mechanisms. These vectors include stealing or guessing user passwords, exploiting existing security vulnerabilities, and conducting phishing campaigns. [1]

The emergence of SafePay follows previous major global ransomware threats. The WannaCry attack in May 2017 targeted Microsoft Windows systems worldwide using the EternalBlue exploit, which spread largely because organizations failed to apply available patches. Additionally, the Akira ransomware group emerged in March 2023, targeting over 250 entities across multiple sectors. [2][3]

CISA Alerts published technical indicators of compromise, incident response steps, and specific mitigation guidance. The agency urged organizations to implement these resilience measures to defend their networks against potential SafePay compromises. [1]