CISA, FBI Warn SafePay Ransomware Has Hit 600 Victims Across Critical Infrastructure

One of the world’s most active ransomware operations now has a victim count in the hundreds. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said on Tuesday that about 600 victims were hit this year by SafePay ransomware, in a joint alert issued with the Federal Bureau of Investigation and the U.S. Secret Service, Reuters reported. The victims range from the Americas to Australia and span multiple critical infrastructure sectors.

“SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors,” said Brett Leatherman, the assistant director of the FBI’s cyber division, according to the Reuters report. The coordinated advisory — designated AA26-293A and published October 20, 2026, according to Undercode News — also brings in German and British law enforcement partners: Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the UK’s North West Regional Organised Crime Unit, according to threat-intelligence tracker Threadlinqs.

What the SafePay Ransomware Advisory Says

The alert describes SafePay as a financially motivated ransomware operation that has been highly active since August 2024, according to the advisory details reported by Threadlinqs. The group’s observed indicators of compromise run from November 2024 through August 2026, and analysts estimate SafePay ranked among the most active ransomware groups of 2026.

SafePay runs the classic double-extortion playbook. The operators gain network access, steal data, and then encrypt the victim’s systems — pressuring victims to pay by threatening to publish the stolen information, the joint statement says. In some cases, according to the agencies, the group calls victims directly to apply pressure. According to Threadlinqs’ analysis of the advisory, SafePay encrypts with a ChaCha20/RSA hybrid scheme and demands cryptocurrency.

How SafePay Gets In: Stolen Credentials and Unpatched Appliances

The advisory points to two main ways in: compromised credentials and known vulnerabilities in internet-facing devices. SafePay gains network access through stolen or guessed passwords, phishing campaigns and brute-force attacks, and by exploiting documented flaws in network security appliances and backup software that were never patched, according to the agencies and Undercode News’ breakdown of the alert.

The advisory lists five exploited CVEs, according to the reporting. CVE-2020-3259 and CVE-2023-20269 affect Cisco ASA and Firepower Threat Defense security products; CVE-2023-27532 and CVE-2024-40711 affect Veeam Backup & Replication; and CVE-2024-40766 affects a SonicWall firewall vulnerability. Notably, several of these flaws are years old — a reminder that a vulnerability being old and patched does not make it harmless on unpatched systems, as Undercode News cautions.

Once inside, SafePay operators reportedly create new accounts or hijack existing ones to maintain access, then rely heavily on legitimate system utilities and administrative tools — a technique known as living off the land — rather than exotic malware. Threadlinqs’ analysis of the advisory names tools including AnyDesk, Mimikatz, PsExec, Rclone, ScreenConnect and WinSCP. The operators also disable endpoint protection and tamper with monitoring and backup systems before encrypting, which can leave victims unable to detect the intrusion quickly or recover cleanly.

“More Than 600 Victims”: Why the Number Matters

Six hundred victims puts SafePay in the top tier of 2026’s ransomware landscape. The advisory says the victims cross North America, South America, Europe and Australia and sit inside critical infrastructure — the power grids, hospitals, water systems and transport networks where disruption carries the highest stakes. Targeted sectors also include manufacturing, technology, managed service providers and government administration, according to Threadlinqs.

Investigators also caution that the figure is a floor, not a ceiling. As Undercode News notes, the 600-victim count reflects the scale reported by the agencies and should not be read as a complete accounting — ransomware investigations routinely surface more incidents over time, and some attacks are never disclosed. The presence of a CVE in the advisory likewise does not prove every SafePay intrusion exploited it.

What Organizations Should Do Now

The advisory is ultimately a defensive checklist, and security practitioners are urging organizations to treat it as one. Drawing on the advisory’s recommendations as reported by Undercode News, the priorities are:

Patch exposed systems. Audit internet-facing Cisco ASA/FTD and SonicWall appliances, plus Veeam Backup & Replication deployments, against the listed CVEs — and verify that the fixes actually took effect.

Lock down remote access. Enforce multifactor authentication on VPNs and administrative interfaces, favor phishing-resistant MFA where practical, and cut off unnecessary external exposure.

Protect the backups. Backup infrastructure is a deliberate SafePay target: compromising it lets attackers disrupt recovery alongside production systems. Isolate backup management from ordinary networks, restrict privileged access, and keep immutable or offline copies of critical data.

Hunt for post-compromise activity. Search logs for suspicious account creation, unexpected privilege escalation, security-tool tampering and unusual use of legitimate administrative tools — and use the advisory’s published indicators of compromise, distributed in STIX and JSON formats, alongside behavioral detections.

An IOC match is a lead for investigation, not automatic proof of compromise — and the absence of a match doesn’t mean an environment is safe, particularly if logging is incomplete. If ransomware activity is suspected, the standard guidance applies: preserve evidence, isolate affected systems, notify authorities, and restore only from verified backups.

Related: OpenAI, Anthropic and Google DeepMind’s cyber safety coordination and Anthropic’s warning about self-replicating AI worms in smart devices.

FAQ: SafePay Ransomware

What is SafePay ransomware?

SafePay is a financially motivated ransomware operation active since August 2024, according to a joint advisory published October 20, 2026, by CISA, the FBI, the U.S. Secret Service and European law enforcement partners. It uses double extortion — stealing data before encrypting systems and threatening to publish it.

How many victims has SafePay hit?

The agencies say about 600 victims this year across multiple critical infrastructure sectors, spanning the Americas, Europe and Australia. Investigators note the count reflects reported cases and the true number may be higher.

How does SafePay break into networks?

Through compromised credentials, phishing and brute-force attacks, and by exploiting known vulnerabilities in internet-facing security appliances and backup software — including listed flaws in Cisco ASA/FTD, Veeam Backup & Replication and SonicWall products. Patches exist for these flaws, but unpatched systems remain exploitable.

What should organizations do?

Patch exposed appliances and backup software, enforce multifactor authentication on remote access, isolate and harden backup infrastructure with offline copies, hunt through logs for the advisory’s indicators of compromise, and preserve evidence before making changes if an intrusion is suspected.