CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors
CISA, FBI, and partners issued a joint advisory warning of the SafePay ransomware group, active in 2026, targeting critical infrastructure sectors globally with tactics to steal data and encrypt systems.
The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), U.S. Secret Service (USSS), and international partners released a joint Cybersecurity Advisory warning organizations about the SafePay ransomware group. The advisory highlights the group’s status as one of the most active ransomware actors in 2026, with approximately 600 victims reported across sectors in the Americas, Europe, and Australia.
SafePay actors gain initial access to victim networks by compromising credentials and exploiting known vulnerabilities in internet-facing devices, often through VPN services. Once inside, they use legitimate IT tools to move laterally within networks, delete or disable backups, steal data, and encrypt systems to extort victims.
The group pressures victims by threatening to publish stolen information and, in some cases, contacting victims directly. The advisory provides observed tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and recommended mitigations to help organizations defend against these attacks.
CISA Acting Executive Assistant Director for Cybersecurity, Chris Butera, emphasized the ongoing targeting of public-facing devices with known vulnerabilities. The FBI’s Assistant Director Brett Leatherman noted the group has already targeted over 600 victims worldwide across multiple critical infrastructure sectors.