Severity: Info Other, enforcement US
CISA, FBI and partners release advisory on SafePay ransomware actors targeting critical infrastructure
Original title: CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors
- Published
- Source: cisa.gov
- Effective
- Not stated
- Deadline
- Not stated
- Framework: CISA
- BOD 26-04: Prioritizing Security Updates Based on Risk source
- in 9 days
- CISA Logging Reference Architecture: outcome-driven guidance for FCEB agencies to build Agency Logging Plans under OMB M-26-14
- Also: MITRE ATT&CK
Why it matters
CISA, FBI, U.S. Secret Service and international partners released a joint advisory warning of SafePay ransomware actors, identified as one of the most active ransomware groups in 2026, affecting approximately 600 victims across the Americas, Europe and Australia. SafePay actors exploit known vulnerabilities in internet-facing devices and use legitimate IT tools to move laterally, delete backups, steal data, and encrypt systems. Organizations should urgently patch known exploited vulnerabilities, implement multifactor authentication, maintain offline backups, segment networks, and keep systems updated to reduce the likelihood and impact of SafePay attacks.
What changed
- CISA, FBI, USSS and international partners published joint Cybersecurity Advisory #StopRansomware: SafePay Ransomware with observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs)
- Advisory documents SafePay actors' attack methodology: compromising credentials and targeting known vulnerabilities in internet-facing devices, often via VPN services
- Advisory identifies SafePay actors' lateral movement and backup destruction tactics using legitimate IT tools to undermine recovery
- Advisory provides specific recommended mitigations including urgent patching of known exploited vulnerabilities, multifactor authentication, offline backups, network segmentation, and system updates
- Advisory warns of SafePay's extortion tactics including data theft threats, publication of stolen information, and direct victim calls to pressure ransom payments
Who is affected
Organizations across critical infrastructure sectors in the Americas, Europe and Australia; approximately 600 victims affected as of October 2026; particularly those with internet-facing devices running known vulnerabilities
What to do
AI-assisted summary of the official document; the official text prevails. Not legal advice.