FBI Warns: SafePay Ransomware Hit 600+ Orgs [2026]

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint warning on October 20, 2026, that SafePay ransomware has compromised at least 600 organizations worldwide since August 2024, with victims spread across critical infrastructure sectors in North America, South America, Europe, and Australia. The advisory, titled “#StopRansomware: SafePay Ransomware” and catalogued as AA26-293A, marks the first coordinated multinational warning to formally label SafePay one of the most active ransomware operations of 2026.

CISA released the advisory alongside the FBI, the U.S. Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency, and the UK North West Regional Organised Crime Unit. The six-agency alliance pooled investigative findings gathered through August 2026 to paint a picture of a ransomware crew that has quietly become one of the most prolific extortion operations active today, according to Cybersecurity Dive.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What the joint SafePay ransomware advisory actually says

The advisory lays out a fairly conventional, if effective, ransomware playbook. SafePay actors get into networks using compromised or stolen credentials, guessed passwords, phishing emails, and by exploiting known vulnerabilities in internet-facing devices such as VPN gateways and firewalls. Once inside, the group has been observed using legitimate IT administration tools to move laterally across a network, a technique that lets malicious activity blend in with normal administrator behavior and slip past basic detection tools.

From there, the pattern matches what security teams have come to expect from double-extortion ransomware crews: disable or delete backups to remove the victim’s recovery options, exfiltrate sensitive data, encrypt production systems, and then demand payment in cryptocurrency. SafePay has also reportedly called victims directly to pressure payment, on top of the standard threat to publish stolen files if the ransom goes unpaid, according to the CISA advisory cited by Infosecurity Magazine.

Brett Leatherman, assistant director of the FBI’s Cyber Division, framed the release as a practical tool for defenders rather than a simple threat bulletin. “Today, the FBI and our partners are giving network defenders clear, actionable guidance to protect their organizations from one of 2026’s most active ransomware groups,” Leatherman said, according to the CISA news release. He added that SafePay actors “have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors.”

Chris Butera, CISA’s acting executive assistant director for cybersecurity, pointed to the group’s preference for exploiting known, unpatched flaws rather than relying on sophisticated zero-days. “Public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay Ransomware group,” Butera said, per the same CISA release. He also urged organizations to move quickly: “With our partners, CISA encourages organizations to review and implement recommended mitigations to include urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised.”

600 victims and counting: the scale of the SafePay problem

The 600-victim figure is the headline number in the advisory, but it deserves some context. That count reflects organizations compromised since SafePay first appeared in August 2024, not a single-year tally, and the agencies describe it as “at least” 600, suggesting the real total could be higher. Earlier private-sector tracking had already flagged SafePay as a group to watch well before this week’s government advisory. A BlacKite report cited in reporting around the advisory found SafePay was the third most active ransomware group in the first four months of 2026, with a particular focus on Germany, and NCC Group separately identified SafePay as the single most active ransomware group in May 2026, with 70 claimed attacks in that month alone.

That trajectory, from a little-known crew in late 2024 to one of the most active ransomware operations tracked by two separate private threat intelligence firms within the span of a year, is what pushed six government agencies across three countries to issue a joint warning. SafePay has also been linked to a high-profile 2025 attack on technology distributor Ingram Micro that disrupted the company’s order processing systems, an incident that put the group on the radar of enterprise security teams well before Tuesday’s advisory formalized the threat.

The geographic spread named in the advisory, North America, South America, Europe, and Australia, signals that SafePay is not a regionally focused operation targeting a single economy. It is opportunistic, chasing exposed infrastructure wherever it finds it. That breadth is part of why critical infrastructure operators, who often run a mix of modern IT systems and older operational technology that is harder to patch quickly, are being singled out in the warning.

How SafePay gets in: the access methods defenders need to watch

The advisory’s access-vector list reads like a greatest-hits collection of ransomware entry points rather than anything exotic. Stolen or compromised credentials, simple password guessing, phishing campaigns, and exploitation of known vulnerabilities in internet-facing devices all appear. VPN-related access, including activity tied to IP addresses associated with the Mullvad VPN service, was also flagged in follow-up reporting on the advisory.

None of these methods require SafePay to develop novel exploit code. They require only that a target organization has an exposed VPN appliance, firewall, or remote access gateway running software with a publicly known flaw that has not yet been patched. That is precisely the gap CISA has spent much of October flagging across its broader advisory output. On October 13, 2026, the agency urged organizations to patch a newly exploited vulnerability in Ivanti Connect Secure, and on October 16 it issued a similar warning for a critical flaw in BeyondTrust Remote Support. Neither alert is formally tied to SafePay in the advisory, but both illustrate the same underlying weakness: edge devices sitting at the perimeter of corporate networks remain the most common way ransomware groups get their first foothold.

That pattern is not unique to SafePay. Earlier in 2026, attackers exploiting unpatched internet-facing software drove the Plex2Shell exploit to roughly 36,000 vulnerable servers, and a separate PHP vulnerability dubbed PHP2Shell was found to affect roughly 70 percent of websites running the language before major cloud providers responded. The throughline across all three incidents is the same: attackers are increasingly automating the discovery of unpatched, internet-facing software at scale, and ransomware crews like SafePay are positioned to capitalize on whatever gets found.

Why backups and lateral movement matter so much in this playbook

Two parts of the SafePay operating model stand out to incident responders: the systematic destruction of backups and the reliance on legitimate administrative tools for lateral movement. Both choices are deliberate, and both make recovery dramatically harder for victims even when they have reasonably mature security programs.

Destroying or disabling backups before deploying encryption payloads removes a victim’s ability to simply restore from a clean copy and ignore the ransom demand. It is a tactic that has become close to standard practice among top-tier ransomware operations, precisely because organizations that cannot recover their own data are far more likely to pay. Using legitimate IT tools for lateral movement, rather than custom malware, helps SafePay actors avoid tripping signature-based detection tools that are tuned to catch known-bad binaries rather than misuse of software that is already approved to run on the network.

Those two techniques together explain why the joint advisory leans so heavily on access and identity controls in its mitigation guidance, rather than just recommending better antivirus signatures. Multifactor authentication, tighter identity and access management, and restricting the use of administrative tools to only the accounts that genuinely need them are all aimed at making the lateral-movement phase of the attack harder, not just the initial break-in.

SafePay advisory at a glance

Detail	What the advisory says
Advisory title	#StopRansomware: SafePay Ransomware
Advisory identifier	AA26-293A
Release date	October 20, 2026 (CISA news release dated October 21, 2026)
Victims identified	At least 600 organizations
Active since	August 2024
Regions targeted	North America, South America, Europe, Australia
Authoring agencies	FBI, CISA, U.S. Secret Service, Landeskriminalamt Rheinland-Pfalz (Germany), UK National Crime Agency, UK North West Regional Organised Crime Unit
Primary access methods	Stolen or guessed credentials, phishing, known vulnerability exploitation, VPN access
Extortion method	Data theft, encryption, threats to publish data, in some cases direct phone calls to victims

How SafePay compares to other ransomware groups flagged in 2026

SafePay is not operating in a vacuum. CISA and the FBI have issued a steady drumbeat of joint ransomware advisories through 2026, and placing SafePay next to those other warnings helps explain why this particular group earned a dedicated bulletin rather than a passing mention. In August 2026, the same agencies, joined by the NSA, DC3, and South Korean authorities, warned about Gunra ransomware targeting critical infrastructure in advisory AA26-222A. That advisory covered a smaller, more narrowly scoped campaign than the one described for SafePay this week.

The scale difference matters. A 600-victim count spanning four continents, confirmed by six separate law enforcement and cybersecurity agencies across three countries, represents a materially larger operation than most of the ransomware warnings CISA has published this year. It also places SafePay in rare company alongside groups like Akira, which separate reporting has tied to roughly $42 million in extorted payments across 250 organizations, a smaller but still significant case that illustrates how lucrative ransomware-as-extortion remains even for mid-tier operations.

What sets SafePay apart from many of its peers is the speed of its rise. Groups that reach the top of monthly ransomware activity rankings, as SafePay did with NCC Group in May 2026, typically take years to build the affiliate networks and initial-access relationships needed to sustain that pace. SafePay appears to have compressed that timeline into roughly two years, a detail that has drawn particular attention from threat intelligence analysts tracking the group’s growth.

Ransomware group	Notable 2026 data point	Source
SafePay	At least 600 victims since August 2024; joint FBI-CISA advisory issued October 20, 2026	CISA advisory AA26-293A
SafePay	Most active ransomware group in May 2026, with 70 claimed attacks that month	NCC Group
SafePay	Third most active ransomware group in the first four months of 2026, focused heavily on Germany	BlacKite
Gunra	Joint advisory AA26-222A issued August 2026 with NSA, DC3, FBI, CISA, and South Korean authorities	CISA advisory AA26-222A
Akira	Roughly $42 million extorted from about 250 organizations	Infosecurity Magazine reporting

Historical context: how ransomware advisories against critical infrastructure have evolved

Joint CISA-FBI ransomware advisories have become something of a routine instrument since the agencies launched the #StopRansomware initiative, but the pattern they follow has shifted over the past few years. Earlier advisories in the series tended to focus on single-country campaigns or specific sector targeting, such as healthcare or education. The SafePay advisory, by contrast, spans four continents and six co-authoring agencies, reflecting a broader trend toward multinational coordination as ransomware operations themselves have become more geographically diffuse.

That shift mirrors what has happened elsewhere in critical infrastructure security this year. Operational technology environments, long considered a separate and more isolated risk category from standard IT networks, have increasingly become a direct target. The French supermarket refrigeration hack, which exposed OT security weaknesses at three vendors and let attackers push stored food temperatures up to 50 degrees Celsius, is one recent example of how attackers are finding paths into operational systems through vulnerabilities that sat exposed for months. A related case involving a Danfoss controller flaw showed a 63-day gap between public disclosure of the bug and its exploitation in the wild, highlighting how much lead time defenders often have, and squander, before known vulnerabilities get weaponized.

Healthcare and public-sector breaches have followed a similar arc. The Oracle Health breach, which Texas’s attorney general said affected 19.9 million people, and law enforcement actions like the FBI’s arrest of a second ShinyHunters suspect this year both point to the same conclusion security agencies are now making explicit in the SafePay advisory: critical infrastructure operators, whether in healthcare, government, or utilities, remain the most consequential targets precisely because the systems they run cannot easily be taken offline to patch.

Market and industry impact of the SafePay warning

For the cybersecurity industry, a joint advisory of this scale functions as both a warning and a demand signal. Managed detection and response vendors, incident response retainers, and backup and recovery software providers typically see renewed interest from enterprise buyers in the days and weeks following a high-profile advisory like this one, particularly from organizations in the sectors explicitly named as targets.

Critical infrastructure operators, utilities, transportation networks, water systems, and manufacturing plants that run legacy operational technology face a harder calculus than typical enterprises. Patching an internet-facing VPN appliance is relatively low-risk for a software company; doing the same for a control system tied to a water treatment plant or a power substation carries operational risk that security teams must weigh against the risk of staying exposed. That tension is precisely why advisories like this one emphasize network segmentation and access restrictions as much as patching, since organizations cannot always patch on the same timeline a security advisory would prefer.

Cyber insurance underwriters are also likely to take notice. A named, government-confirmed ransomware group with 600-plus victims and documented backup-destruction tactics gives underwriters concrete language to point to when assessing an applicant’s patching cadence, backup architecture, and identity controls during policy renewals.

Mitigation guidance: what the advisory recommends

The joint advisory’s recommendations track closely with what CISA has pushed in prior #StopRansomware bulletins, but the specifics are worth laying out because they map directly onto SafePay’s documented tactics.

Patch internet-facing systems promptly, with particular urgency for firewalls, VPN gateways, and other edge devices that sit at the network perimeter
Apply Zero Trust principles rather than assuming internal network traffic is inherently trustworthy
Restrict administrative tools and privileges so that compromised accounts cannot easily be used for lateral movement
Strengthen account security with multifactor authentication and tighter identity and access management
Isolate potentially compromised hosts quickly to limit the blast radius of an active intrusion
Conduct proactive threat hunting rather than waiting for alerts to surface an active compromise
Maintain offline or otherwise protected backups that cannot be reached or disabled by an attacker who has gained administrative access

Organizations that believe they may already be compromised are directed to report through the FBI’s Internet Crime Complaint Center, a local FBI field office, the U.S. Secret Service, or CISA’s incident-reporting channels and 24/7 operations center.

What SafePay’s rise means for software supply chains

SafePay’s reliance on known, unpatched vulnerabilities rather than custom-built exploits connects this advisory to a broader pattern playing out across the software ecosystem in 2026. Automated vulnerability discovery, increasingly aided by AI tooling on both the offensive and defensive sides, has shortened the window between a flaw’s disclosure and its mass exploitation. That dynamic has already shown up in incidents like the npm package compromises addressed by GitHub’s trusted publishing rollout and in the rapid spread of PHP2Shell across unpatched web infrastructure.

For software vendors whose products sit at the network edge, VPN appliance makers, firewall vendors, and remote access tool providers, the SafePay advisory adds pressure to shorten patch-release timelines and to make patching itself less disruptive for customers running mission-critical systems. The gap between vulnerability disclosure and real-world exploitation has become the single most consequential window in enterprise security, and ransomware groups like SafePay are built specifically to operate inside it.

Predictions: where the SafePay threat goes from here

A handful of outcomes seem likely in the months following this advisory, based on how past #StopRansomware warnings have played out and on SafePay’s documented growth pattern.

Victim counts will almost certainly climb past 600 in follow-up reporting, since advisories typically reflect investigative findings compiled weeks or months before publication, and SafePay’s activity through August 2026 is already the baseline figure cited.
Expect at least one or two additional private threat intelligence reports in the next quarter ranking SafePay among the most active ransomware groups, continuing the trend set by BlackKite and NCC Group earlier in 2026.
Critical infrastructure operators named implicitly in the advisory’s sector language will likely accelerate VPN and firewall patching cycles, at least temporarily, following the publicity around this warning.
Additional law enforcement agencies beyond the current six may join future SafePay-related advisories or takedown actions, given the group’s multinational victim footprint.
Backup vendors and managed detection providers will likely cite this advisory directly in sales and marketing materials aimed at critical infrastructure customers over the coming weeks.

What security teams should do this week

For security teams reading the advisory for the first time, the practical starting point is an inventory check: which internet-facing devices, VPN concentrators, firewalls, and remote access gateways, are running software with known, unpatched vulnerabilities right now. That single question maps directly onto SafePay’s primary access method and onto the broader pattern seen in incidents like the Ivanti Connect Secure flaw CISA flagged earlier in October.

The second priority is backup resilience. Given SafePay’s documented habit of disabling or deleting backups before deploying encryption, any backup architecture that an administrator account can reach and modify should be treated as a liability rather than a safety net. Immutable, offline, or otherwise isolated backup copies are the difference between a contained incident and a full-blown ransom negotiation.

Leatherman’s closing point in the CISA release is worth repeating in full because it frames the advisory as actionable rather than purely informational: “By following these recommendations, network defenders can significantly reduce both the likelihood and the impact of a SafePay ransomware attack.” That is a modest claim, deliberately so, but it is also the entire point of publishing a joint advisory of this scale in the first place.

Frequently asked questions about the SafePay ransomware advisory

What is SafePay ransomware?

SafePay is a ransomware operation that the FBI and CISA say has been active since August 2024. It steals data, encrypts victim systems, and demands cryptocurrency payment while threatening to publish stolen information if victims refuse to pay.

How many organizations has SafePay hit?

The joint advisory released October 20, 2026, says SafePay has affected at least 600 organizations worldwide since August 2024, spanning critical infrastructure sectors across North America, South America, Europe, and Australia.

Which agencies issued the SafePay ransomware advisory?

The advisory, numbered AA26-293A, was jointly issued by the FBI, CISA, the U.S. Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency, and the UK North West Regional Organised Crime Unit.

How does SafePay gain access to victim networks?

According to the advisory, SafePay actors primarily use compromised or stolen credentials, guessed passwords, phishing, exploitation of known vulnerabilities in internet-facing devices, and VPN-related access to gain an initial foothold.

Does SafePay destroy backups before encrypting systems?

Yes. The advisory describes SafePay actors disabling or deleting backups as part of their post-compromise activity, a tactic aimed at removing a victim’s ability to recover data without paying the ransom.

What should organizations do to protect against SafePay?

CISA recommends urgently patching known exploited vulnerabilities, especially on firewalls and VPN gateways, applying Zero Trust principles, restricting administrative privileges, strengthening account security with multifactor authentication, isolating compromised hosts, and maintaining backups an attacker cannot reach or disable.

Is SafePay connected to any previous major breaches?

SafePay has been linked to a 2025 attack on technology distributor Ingram Micro that disrupted its order processing systems, an incident that drew attention to the group before this week’s joint government advisory.

Where should victims report a suspected SafePay compromise?

The advisory directs potentially affected organizations to report through the FBI’s Internet Crime Complaint Center, a local FBI field office, the U.S. Secret Service, or CISA’s incident-reporting channels and 24/7 operations center.

FBI, CISA Warn SafePay Ransomware Hit 600 Orgs [2026]