The FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), alongside European authorities, have warned that the SafePay ransomware group has emerged as one of the world’s most active ransomware operations, targeting critical infrastructure providers across multiple regions.
According to a joint cybersecurity advisory, SafePay has attacked more than 600 critical infrastructure providers since 2024, with victims concentrated in North and South America, Europe and Australia.
Although the agencies have not publicly explained the timing of the advisory, security researchers say it provides an authoritative assessment of an ongoing threat to U.S. organizations.
Cynthia Kaiser, senior vice president of the Halcyon Ransomware Research Center, said SafePay continues to pose a significant threat despite an apparent decline in attack volumes from their peak at the end of 2025. The group has consistently targeted approximately 15 to 30 organizations per month throughout 2026, she said.
High-Profile Attacks Highlight SafePay’s Reach
SafePay has been linked to several major ransomware incidents, including the July 2025 attack on Ingram Micro, the California-based technology distributor.
The incident disrupted the company’s ability to process orders for several days. Data breach notifications filed with state regulators also indicated that personal information belonging to more than 42,000 individuals had been stolen.
The incident underscores the potential operational and data-security consequences of SafePay’s campaigns, particularly for organizations that play important roles in technology supply chains.
Exploiting Credentials and Vulnerable Network Devices
According to authorities, SafePay operators commonly gain initial access to victim networks through compromised credentials, vulnerabilities in internet-facing devices and virtual private network (VPN) connections.
The group has exploited several vulnerabilities in network edge devices, including CVE-2020-3259 and CVE-2023-20269, to establish an initial foothold in targeted environments.
These techniques can provide attackers with access to enterprise networks, allowing them to escalate privileges and move deeper into compromised systems.
Abuse of Legitimate Administrative Tools
Once inside a network, SafePay operators frequently use legitimate system administration utilities to execute commands and expand their access while attempting to avoid detection.
Authorities identified Windows Remote Management (WinRM) and PsExec among the tools used in the group’s living-off-the-land techniques, which rely on existing system capabilities rather than exclusively on custom malware.
The attackers also commonly disable security software before moving laterally across compromised networks. They then use Remote Desktop Protocol (RDP) to access additional systems and search for credentials that could provide administrative privileges.
This combination of compromised accounts, vulnerable network devices and legitimate administrative tools can complicate detection, as much of the activity may resemble normal IT operations.
Organizations Urged to Strengthen Defences
The joint advisory highlights the persistent threat posed by ransomware operators that combine multiple access methods with credential theft, lateral movement and security-tool evasion.
Organizations operating critical infrastructure and other essential services should prioritize patching vulnerable internet-facing devices, securing VPN access, enforcing strong authentication, monitoring privileged accounts and detecting suspicious use of remote administration tools.
The advisory also reinforces the importance of maintaining tested offline backups and effective incident-response procedures to limit disruption if a ransomware attack succeeds.
With SafePay continuing to target organizations throughout 2026, cybersecurity teams are being urged to treat the group as an ongoing threat and strengthen their defences against both initial compromise and subsequent movement within corporate networks.
Photo — Julia Lopez (Unsplash)
Leave a Reply