Back Vitallaw

CISA, Partners Issue Warning About Prolific Ransomware Group

Vitallaw • October 22, 2026

Cyber defense agencies in the U.S., Germany, and United Kingdom yesterday warned that a prolific ransomware group has been disrupting critical infrastructure and offered advice on preventing attacks.

“Since August 2024, SafePay ransomware group ...

Cyber defense agencies in the U.S., Germany, and United Kingdom yesterday warned that a prolific ransomware group has been disrupting critical infrastructure and offered advice on preventing attacks.

“Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors,” according to the agencies’ joint cybersecurity advisory .

Issued by the Cybersecurity and Infrastructure Security Agency, the U.S. Secret Service, the Federal Bureau of Investigation, and law enforcement agencies in the U.K. and Germany, the advisory provides information how to identify and block SafePay’s attack vectors.

“SafePay actors gain access to victim networks by compromising credentials and targeting known vulnerabilities in internet-facing devices, often connecting through virtual private network (VPN) services,” CISA said in a news release .

“Once inside, they use legitimate IT tools to move through networks and undermine recovery by deleting or disabling backups. They then steal data and encrypt systems, pressuring victims to pay by threatening to publish stolen information and, in some cases, calling victims directly,” CISA said.

“Public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay Ransomware group,” said Chris Butera, CISA’s acting executive assistant director–cybersecurity. “With our partners, CISA encourages organizations to review and implement recommended mitigations to include urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised.”

News: FederalLegislation DataSecurity

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SafePay Ransomware Hits 600+ Organizations Worldwide The FBI, CISA, and U.S. Secret Service issued a joint advisory on October 20, 2026, warning that the SafePay ransomware group has compromised at least 600 organizations globally since August 2024, affecting critical infrastructure sectors. SafePay employs various attack vectors, including credential theft, brute-force attacks, and exploiting vulnerabilities in VPNs and edge devices. Specific vulnerabilities exploited include CVE-2020-3259, CVE-2023-27532, and CVE-2024-40711. The group operates a double-extortion model, stealing data before encrypting systems and threatening to publish the stolen information if ransoms are not paid. The advisory provides detailed tactics, techniques, and procedures (TTPs) for defenders to mitigate risks. Authorities emphasize the urgency of patching known vulnerabilities and implementing multifactor authentication to protect against these attacks. 9 sources 74

Extracted Entities

CISA, Partners Issue Warning About Prolific Ransomware Group

The full story

Extracted Entities

Attack Types (1)

Countries (2)

MITRE ATT&CK (3)

Ransomware Groups (1)