Skip to content
SafePay Ransomware Group Targets 600 Organizations Worldwide

SafePay Ransomware Group Targets 600 Organizations Worldwide

First seen 21 Oct 2026, 12:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 17:09 UTC
  • •SafePay has targeted over 600 organizations globally since its emergence.
  • •The group employs double extortion tactics, exfiltrating data before encrypting systems.
  • •CISA warns of vulnerabilities exploited by SafePay, urging immediate patching and enhanced security measures.

The SafePay ransomware group has compromised at least 600 critical infrastructure organizations globally, as reported by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and other agencies. Active since August 2024, SafePay employs double extortion tactics, exfiltrating data and encrypting systems to pressure victims into paying ransoms. The group has been linked to significant attacks, including a breach of Conduent Business Services, affecting over 62 million individuals. SafePay uses various techniques for initial access, including credential exposure and exploiting known vulnerabilities in internet-facing devices, such as CVE-2024-40766 and CVE-2023-27532. The advisory emphasizes the need for organizations to patch vulnerabilities and implement stricter access controls. The rise in ransomware incidents is attributed to a competitive landscape among gangs, with SafePay being one of the most active groups in 2026. Recent reports indicate that ransomware attacks have surged, with almost 3,000 incidents recorded in Q3 2026 alone.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2020-05-06
CVE-2020-3259 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2023-03-10
CVE-2023-27532 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2023-09-06
CVE-2023-20269 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-08-23
CVE-2024-40766 published
A critical vulnerability in Cisco Adaptive Security Appliance was disclosed, later exploited by ransomware groups.
Hipaajournal
2024-09-07
CVE-2024-40711 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-09-09
CVE-2024-40766 added to CISA KEV
CISA listed the vulnerability as actively exploited, highlighting its critical nature.
Hipaajournal
2026-10-20
CISA issues advisory on SafePay
CISA confirmed SafePay's attacks on 600 organizations and detailed their tactics and vulnerabilities exploited.
Wtvbam

More articles in this cluster (11)

Following this threat?

Track Inc Ransom, Conduent and CVE-2020-3259 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 3

Common questions

What sectors are affected by SafePay?
SafePay has targeted various sectors, including critical infrastructure in North America, South America, Europe, and Australia.
What vulnerabilities should we patch?
Organizations should prioritize patching CVE-2024-40766, CVE-2023-27532, and other known vulnerabilities exploited by SafePay.
How can we protect against these attacks?
Implement strict access controls, regularly update systems, and monitor for unusual activity to mitigate risks from ransomware attacks.