Federal agencies warn SafePay ransomware hit 600 critical infrastructure organizations

The Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, the United States Secret Service, and international partners published a joint advisory on October 20 detailing attacks by the SafePay ransomware group. The agencies reported that the ransomware has impacted at least 600 organizations across multiple critical infrastructure sectors worldwide. [1][2][3][4][5][6][7][8][9][10]

Federal authorities describe SafePay as one of the most active ransomware operations. According to eSecurity Planet, international agencies participating in the advisory include authorities from the United States, the United Kingdom, and Germany. [1][6][8]

As FTMQ Security reported earlier, SafePay operators have targeted critical infrastructure across four continents since August 2024. The attackers gain initial entry into target networks by stealing passwords, exploiting technical vulnerabilities, and using phishing campaigns. [1][7][14]

Ransomware targets private data and systems, locking files or exfiltrating information until a ransom is paid. Federal authorities recommend that organizations implement security mitigations and review released indicators of compromise to protect corporate networks from intrusion. [1][5][11][14]