Skip to content
SafePay Ransomware Targets Over 600 Critical Infrastructure Organizations

SafePay Ransomware Targets Over 600 Critical Infrastructure Organizations

First seen 20 Oct 2026, 19:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 09:46 UTC
  • •SafePay ransomware has affected over 600 critical infrastructure organizations since August 2024.
  • •The group uses a double-extortion model, stealing data before encrypting systems.
  • •Organizations are urged to implement multifactor authentication and restrict admin privileges.

The SafePay ransomware group has breached more than 600 critical infrastructure organizations globally since August 2024, according to a joint advisory from CISA, the FBI, and other agencies. SafePay employs various methods to gain initial access, including credential exposure, brute force attacks, and exploiting known vulnerabilities in VPNs and other internet-facing devices. The group utilizes a double-extortion model, stealing sensitive data before encrypting systems and threatening to leak the data if ransoms are not paid. Key vulnerabilities exploited by SafePay include CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. Organizations are advised to implement multifactor authentication and restrict administrative privileges to mitigate risks. The advisory underscores the importance of reporting incidents to law enforcement, as paying ransoms does not guarantee file recovery. SafePay has been particularly active in targeting businesses across North America, South America, Europe, and Australia.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2020-05-06
CVE-2020-3259 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2023-03-10
CVE-2023-27532 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2023-09-06
CVE-2023-20269 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-04-20
Public exploit for CVE-2025-70795 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2024-08-01
SafePay ransomware group emerges
SafePay ransomware first appeared, quickly gaining notoriety for targeting critical infrastructure.
Acronis
2024-08-23
CVE-2024-40766 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2024-09-07
CVE-2024-40711 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
CISA issues advisory on SafePay
CISA and FBI report SafePay has breached over 600 organizations, urging victims to report incidents.
Cisa
2026-10-21
SafePay ransomware hits critical infrastructure
CISA confirms SafePay's activities have impacted critical infrastructure organizations worldwide.
BleepingComputer

More articles in this cluster (19)

Following this threat?

Track Lockbit and CVE-2020-3259 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (17)

1 / 3

Common questions

What methods does SafePay use to gain access?
SafePay uses credential exposure, brute force attacks, and exploits known vulnerabilities in VPNs and other systems.
What should organizations do to protect themselves?
Organizations should implement multifactor authentication, restrict administrative privileges, and regularly update their systems.
Is paying the ransom effective?
Paying the ransom does not guarantee recovery of encrypted files, and victims are encouraged to report incidents to law enforcement.