Essential Insights
-
SafePay has compromised roughly 600 organizations across critical infrastructure sectors in the Americas, Europe, and Australia, with activity rising since August 2024.
-
The group breaks in through stolen or guessed credentials, VPN access, phishing, and unpatched internet-facing systems, then uses legitimate tools and new or hijacked accounts to move through networks and disable security protections.
-
SafePay steals and encrypts data, disrupts backups, and demands cryptocurrency—often threatening to publish stolen information and contacting victims directly to pressure them.
- CISA, the FBI, USSS, and partners urge prompt patching and stronger defenses: use MFA and least-privilege access, maintain tested offline immutable backups, monitor and segment networks, and isolate affected systems quickly if a compromise is suspected.
The Issue
CISA, the FBI, the U.S. Secret Service, and international partners warn that SafePay ransomware actors have compromised roughly 600 organizations across critical infrastructure sectors in the Americas, Europe, and Australia. The group has been active since August 2024. It reportedly gains access through stolen or guessed passwords, phishing, and vulnerabilities in internet-facing systems, including VPNs. Once inside, attackers create or seize accounts, move through networks using legitimate tools, disable security protections, steal data, and encrypt files. They then demand cryptocurrency, often threatening to publish stolen information if victims refuse to pay.
The campaign targets organizations to extract ransom payments and exert pressure through data theft and operational disruption. In response, the agencies urge businesses to patch known vulnerabilities promptly, strengthen account security with multifactor authentication, maintain tested offline backups, and monitor networks for suspicious activity. They also advise organizations that spot an intrusion early to isolate affected systems and investigate before taking steps to remove the attackers. The warning and recommendations were reported by Industrial Cyber.
Risk Summary
The reported SafePay ransomware campaign shows how an attack affecting hundreds of critical organizations can also reach an ordinary business. No company is too small or too specialized: attackers exploit unpatched systems, stolen credentials, and weak network boundaries. Once inside, they can encrypt essential files, disrupt operations, and potentially steal sensitive data. Consequently, a business may face lost revenue, costly recovery, legal or regulatory exposure, and lasting damage to customer trust. Patch systems promptly, restrict access, segment networks, maintain tested offline backups, and rehearse incident response. These measures cannot eliminate risk, but they can limit an attack’s reach and help the business recover faster.
Possible Remediation Steps
With SafePay ransomware reportedly affecting 600 critical organizations worldwide, rapid remediation can limit further compromise, disruption, and data loss.
Mitigation and Recovery
- Identify exposure: Check current threat advisories and asset inventories to determine whether exposed systems, software, or accounts may be at risk. Prioritize internet-facing systems and actively exploited vulnerabilities.
- Patch and verify: Apply vendor-approved security updates promptly. Test changes where needed, then confirm that patches took effect and vulnerable services are no longer exposed.
- Strengthen network defenses: Restrict remote access, disable unnecessary services, segment critical systems, and block unauthorized traffic between network zones. Require multifactor authentication for remote and privileged access.
- Contain suspected intrusions: Isolate affected devices and network segments immediately. Preserve logs and forensic evidence; avoid wiping or rebuilding systems before responders can assess the incident.
- Hunt for persistence: Review endpoint, identity, and network activity for suspicious access, lateral movement, and unauthorized changes. Reset exposed credentials and revoke compromised sessions or access tokens.
- Protect recovery copies: Maintain encrypted, offline or immutable backups, and test restoration procedures. Restore only to clean systems after confirming the threat has been removed.
- Coordinate response: Use the organization’s incident-response plan, involve security and business leaders, and notify relevant authorities, regulators, and partners as required.
- Improve resilience: After recovery, review how the intrusion occurred, close remaining gaps, and update monitoring and response procedures in line with the NIST Cybersecurity Framework.
Explore More Security Insights
Stay informed on the latest Threat Intelligence and Cyberattacks.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
