Western security agencies warn of active SafePay ransomware attacks

Cybersecurity agencies in the United States, the United Kingdom, and Germany issued a joint advisory warning that a ransomware group known as SafePay has compromised at least 600 organizations worldwide. BankInfoSecurity, eSecurity Planet, and Howl.link all reported on the government warning regarding the active threat. The victims span multiple critical infrastructure sectors that have been impacted since August 2024. [1][3][5]

BankInfoSecurity reported that the financially motivated campaigns use double-extortion tactics. The hackers steal data before swiftly encrypting systems. According to BankInfoSecurity, the group targets firewalls, virtual private networks, and backup infrastructure to gain initial access and disrupt operations. [1]

As FTMQ Security reported earlier, initial access vectors used by SafePay include stolen passwords, phishing, and vulnerability exploitation. SafePay malware exfiltrates private data and encrypts files to demand payments, which are typically requested in cryptocurrency to evade law enforcement tracing. [6][8]

The Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, the United States Secret Service, and international allies released indicators of compromise alongside mitigation guidance for network defenders to help organizations secure their networks against the ongoing attacks. [1][8]