Skip to content
SafePay Ransomware Group Targets Critical Infrastructure Worldwide

SafePay Ransomware Group Targets Critical Infrastructure Worldwide

First seen 20 Oct 2026, 19:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 20:17 UTC

The SafePay ransomware group has been active since August 2024, impacting over 600 victims across various sectors in North America, South America, Europe, and Australia. This group employs a double extortion model, stealing data before encrypting it and demanding ransom in cryptocurrency. Their attack methods include exploiting vulnerabilities, phishing, and credential theft. Key CVEs associated with their operations include CVE-2024-40766 and CVE-2024-40711, both categorized as critical. Organizations are urged to implement security measures such as multifactor authentication and regular system updates to mitigate risks. The FBI and CISA have issued advisories detailing the group's tactics, techniques, and procedures (TTPs). As of October 2026, SafePay remains one of the most active ransomware groups, with significant ongoing threats to critical infrastructure.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2020-05-06
CVE-2020-3259 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2023-03-10
CVE-2023-27532 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2023-09-06
CVE-2023-20269 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-08-23
CVE-2024-40766 published
A critical vulnerability exploited by SafePay was published, affecting various systems.
Cisa
2024-09-07
CVE-2024-40711 published
Another critical vulnerability exploited by SafePay was published, increasing risk.
Cisa
2024-09-09
CVE-2024-40766 added to CISA KEV
CISA confirmed active exploitation of CVE-2024-40766, a critical vulnerability.
Cisa
2024-10-17
CVE-2024-40711 added to CISA KEV
CISA added CVE-2024-40711 to its KEV catalog, indicating active exploitation.
Cisa
2026-10-20
Joint advisory released
FBI and CISA released a joint advisory detailing SafePay's TTPs and IOCs.
Cisa

More articles in this cluster (5)

Following this threat?

Track Lockbit and CVE-2024-40711 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 3

Common questions

What sectors are affected by SafePay?
SafePay has targeted various sectors, including critical infrastructure across multiple continents.
How can organizations protect against SafePay ransomware?
Organizations should implement multifactor authentication, regularly update systems, and follow Zero Trust principles.
What is the current status of SafePay's activities?
SafePay remains highly active, with ongoing threats and confirmed exploitation of critical vulnerabilities.