Skip to content
FBI and CISA Warn of SafePay Ransomware Targeting 600 Firms

FBI and CISA Warn of SafePay Ransomware Targeting 600 Firms

First seen 21 Oct 2026, 19:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 21:09 UTC
  • •SafePay ransomware has impacted over 600 organizations since August 2024.
  • •Attack methods include credential compromise and exploiting known vulnerabilities in VPNs.
  • •The joint advisory provides specific mitigations to help organizations defend against attacks.

On October 20, 2026, the FBI, CISA, and U.S. Secret Service issued a joint advisory about the SafePay ransomware group, which has affected at least 600 organizations globally since August 2024. The advisory outlines SafePay's tactics, including credential compromise and exploitation of known vulnerabilities in internet-facing devices, particularly through VPNs. Once inside, the group uses legitimate IT tools to navigate networks, delete backups, and encrypt systems while threatening to publish stolen data. The advisory emphasizes the need for organizations to implement specific mitigations, such as patching known vulnerabilities and maintaining offline backups. SafePay's rapid growth and targeting of critical infrastructure sectors highlight an alarming trend in ransomware operations. The advisory is part of the ongoing #StopRansomware initiative aimed at providing actionable guidance to network defenders.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Joint advisory issued by FBI and CISA
The FBI, CISA, and U.S. Secret Service released an advisory detailing SafePay's tactics and impact on over 600 organizations.
Cisa
2026-10-21
Shattered reports on SafePay advisory
Shattered published an analysis of the joint advisory, emphasizing SafePay's rapid growth and targeting of critical infrastructure.
Shattered

More articles in this cluster (3)

Following this threat?

Track Safepay in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 4

Common questions

What organizations are affected?
At least 600 organizations across multiple sectors, including critical infrastructure, have been impacted by SafePay.
How does SafePay gain access?
SafePay typically compromises credentials and exploits known vulnerabilities in internet-facing devices, particularly through VPNs.
What should organizations do to protect themselves?
Organizations are advised to patch known vulnerabilities, implement multifactor authentication, and maintain offline backups.