The joint alert found SafePay one of the most active ransomware threats in 2026SafePay has hit about 600 victims in the Americas, Europe and AustraliaAdvisory urges patching exploited flaws, multifactor authentication, offline backups and network segmentationThe Cybersecurity and Infrastructure Security Agency on Wednesday released a #StopRansomware advisory on SafePay, one of the most prolific ransomware groups of 2026. CISA issued the advisory jointly with the FBI, the U.S. Secret Service and international partners.The advisory details how the group breaks into and extorts critical infrastructure organizations. It lists SafePay’s tactics, techniques and procedures, its indicators of compromise and steps to limit the damage from an attack.Bobby Thompson, acting associate director for threat hunting at CISA, will deliver a keynote address at the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10, where government and industry leaders will discuss resources needed to counter evolving digital and physical threats. Register now to hear from the officials shaping technology priorities to safeguard U.S. borders and critical infrastructure. How Do SafePay Actors Gain Access?The group usually gets into networks with stolen credentials or by exploiting known flaws in internet-facing devices. It often routes its traffic through virtual private network services. Once inside, the actors use legitimate administrative software to move laterally and delete or disable backups to hamper recovery. They steal data before encrypting systems, then threaten to leak the stolen files and sometimes phone victims to press for payment.Chris Butera, CISA’s acting executive assistant director for cybersecurity, said organizations should act on the advisory by “urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised.”Which Organizations Has SafePay Targeted?The advisory puts SafePay’s victim count at roughly 600 across the Americas, Europe and Australia. Brett Leatherman, assistant director of the FBI’s Cyber Division, said the actors have already reached organizations in several critical infrastructure sectors. He said the advisory gives network defenders “clear, actionable guidance.”The alert follows earlier joint warnings on three other groups:Gunra, an affiliate-driven operation with victims in five world regionsAkira, which had collected about $42 million in ransoms from more than 250 organizations by late 2025Ghost, a China-based group whose attacks had compromised organizations in more than 70 countriesWhat Mitigations Do the Agencies Recommend?The co-signing agencies advise organizations to:Update operating systems, software and firmware regularlyRequire multifactor authenticationFix known exploited vulnerabilities on internet-facing systems firstKeep offline data backups and routinely test that restoration worksSegment networks to stop ransomware from spreading
Click Here For The Original Source.
——————————————————–
