The FBI and the Cybersecurity and Infrastructure Security Agency warned that SafePay has expanded its attacks against critical infrastructure providers to become one of the world’s most active ransomware operations.
Since 2024, Safepay has struck more than 600 critical infrastructure providers, with particular focus on North and South America, Europe and Australia, according to an advisory issued jointly by U.S. and European authorities.
It is not immediately known why the agencies chose now to issue the advisory, but security researchers say it should be viewed as a “verified and authoritative record” of a group that poses an ongoing, persistent threat to the U.S.
“SafePay certainly poses such a threat,” said Cynthia Kaiser, senior vice president of Halcyon Ransomware Research Center. “While the volume of SafePay attacks appeared to have peaked at the end of 2025, they have consistently targeted around 15-30 organizations each month throughout 2026.”
High profile attacks
As previously reported, SafePay has been linked to some high-profile ransomware cases, including the July 2025 Ingram Micro attack. The California-based technology distributor said its ability to process orders was disrupted for days and personal data belonging to more than 42,000 people was stolen, according to data breach notices filed with state regulators.
SafePay actors have used compromised credentials to gain access to victim networks. The group has also targeted known vulnerabilities in internet-facing devices and often uses virtual private networks to gain access to systems, according to authorities.
SafePay actors have exploited a number of vulnerabilities in edge devices to gain initial access, including CVE-2020-3259 and CVE-2023-20269.
Legitimate tools
SafePay actors have gained administrative access on new or used accounts by using living-off-the-land techniques, such as Windows Remote Management or a tool called PsExec, to execute commands on remote systems.
The hackers often disable security software in preparation for lateral movement. After moving laterally, the hackers typically use Remote Desktop Protocol to expand their presence inside the network and search for credentials to gain administrative access, according to the advisory.
The group has used legitimate tools, including FileZilla, 7-Zip and WinRAR, for file compression and data collection. They then use WinSCP and RClone to exfiltrate data from the network to accounts they control, according to the advisory.
To prevent such attacks, authorities recommend several steps for security teams:
Remediate known exploited vulnerabilities.
Implement identity, credential and access management policies, and require multifactor authentication, particularly for VPN accounts.
Maintain offline backups that are encrypted and immutable.
Segment networks to prevent the spread of ransomware.
Click Here For The Original Source.
——————————————————–
