FBI and CISA Warn: SafePay Ransomware Has Hit 600+ Organizations

On October 20, 2026, CISA, the FBI and international partners published a joint #StopRansomware advisory (AA26-293A) on SafePay, a ransomware operation that has become one of the most active in the world. The advisory is useful reading because it is specific about how SafePay gets in, and most of those doors can be closed.

• CISA says SafePay has affected at least 600 organizations since August 2024, across multiple critical infrastructure sectors.
• The real number is likely higher. SafePay's leak site only lists victims who do not pay.
• The advisory was co-authored by the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the North West Regional Organised Crime Unit.
• The technical indicators and tactics in the advisory cover activity from November 2024 to August 2026.
• Since early 2025, SafePay has been one of the most active ransomware operations, filling the gap left by BlackCat (ALPHV) and LockBit.

According to the advisory, initial access comes from:

• Exposed or stolen credentials
• Brute-force password attacks
• VPN access, particularly through IP addresses associated with the Mullvad VPN provider
• Phished account profiles
• Automated scripts exploiting known vulnerabilities in edge devices and other internet-exposed systems

None of these are exotic. They are the everyday weak points of most mid-sized networks.

• Double extortion. Data is stolen before encryption, and victims are threatened with leaks.
• Shadow copies are deleted.
• Backup storage is reset. The group resets network-attached storage devices that hold backups, which is designed to make recovery impossible without paying.

That last point matters: backups that are reachable from the compromised network are not a safe plan on their own.

1. 01Enforce multifactor authentication and put identity, credential and access management (ICAM) policies in place. Stolen passwords should not be enough.
2. 02Restrict administrative tools and privileges to limit lateral movement after a compromise.
3. 03Patch edge devices first. Prioritize VPNs, firewalls and other internet-facing systems, especially flaws in CISA's Known Exploited Vulnerabilities catalog.
4. 04Report incidents to law enforcement. The agencies note that paying a ransom does not guarantee you get your files back.

• MFA on every VPN, remote access tool, email account and admin console
• Review VPN logs for logins from unexpected IP ranges or VPN providers
• Patch internet-facing devices on a fast track; remove ones you no longer need
• Rotate and audit old, shared and service-account credentials
• Keep at least one offline or immutable backup that cannot be reached from your domain
• Test restores, not just backups
• Write down who decides what in the first hour of an incident, and rehearse it

We help organizations harden remote access, review edge-device exposure and build ransomware-ready backup and response plans. Talk to our team.