CISA and FBI Warn of SafePay Ransomware Threat
Attackers exploit exposed systems and stolen credentials, disable backups and threaten to release victims’ data.
- By Jesse Jacobs
- Oct 23, 2026
About 600 victims across the Americas, Europe and Australia have been affected by SafePay ransomware, according to a joint warning from U.S. cybersecurity and law enforcement agencies and overseas partners.
The Cybersecurity and Infrastructure Security Agency (CISA), FBI and U.S. Secret Service identified activity affecting several critical infrastructure sectors. Their advisory outlines intrusion methods, evidence defenders can search for and measures intended to limit damage.
SafePay operators exploit previously identified security flaws in devices accessible from the internet and use compromised login information to enter networks. Virtual private network connections frequently provide a route into targeted systems.
After gaining entry, attackers use administrative software to reach additional systems. They also interfere with recovery efforts by erasing backups or preventing their use.
The group takes sensitive information before locking systems through encryption. Extortion demands include threats to disclose the stolen material, with some victims also receiving telephone calls.
The agencies recommend prioritizing fixes for vulnerabilities already being exploited, particularly on equipment exposed to the internet. They also advise keeping software and device firmware current and requiring more than a password to authenticate users.
Additional recommendations include separating network environments to restrict an attacker’s movement and keeping backup copies disconnected from production systems. Organizations should routinely verify that those copies can restore operations.