The FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and five other law enforcement partners released a joint advisory on October 20, 2026, warning that SafePay ransomware has hit roughly 600 organizations across North America, South America, Europe, and Australia since the group surfaced in August 2024. The advisory, titled “#StopRansomware: SafePay Ransomware” and catalogued as AA26-293A, names critical infrastructure operators as a primary target and lays out the group’s playbook for breaking into networks through virtual private network (VPN) services and other internet-facing devices.Inside Advisory AA26-293A: What the Government DisclosedA Six-Agency, Three-Continent CoalitionWho Is SafePay? Tracking a Ransomware Group Since August 2024The Numbers: 600 Victims Across Four ContinentsHow SafePay Breaches Networks: Initial Access TechniquesFrom Foothold to Encryption: The Post-Compromise PlaybookSafePay Advisory AA26-293A at a GlanceWhat FBI and CISA Officials Are SayingWhy Critical Infrastructure Keeps Getting HitSafePay vs Other Major Ransomware Groups in 2026Historical Context: From WannaCry to Ransomware-as-a-ServiceMarket Impact: What This Means for Cybersecurity SpendingMitigation Guidance: What CISA Wants Organizations to Do NowFor IT and Security TeamsFor Executives and BoardsPredictions: Where SafePay and Ransomware-as-a-Service Go NextFrequently Asked Questions About SafePay RansomwareWhat is SafePay ransomware?How many victims has SafePay ransomware claimed?What is advisory AA26-293A?How does SafePay ransomware gain initial access to networks?What should organizations do to protect against SafePay ransomware?Is SafePay ransomware linked to a specific country or group?Which sectors has SafePay ransomware targeted?How does SafePay compare to other major ransomware groups like LockBit or Akira?Related Coverage
The release comes from an unusually wide coalition: CISA, the FBI, the U.S. Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency, and the North West Regional Organised Crime Unit all signed on. That lineup signals how far SafePay’s reach has spread in just over two years, and why agencies on three continents felt compelled to issue coordinated guidance rather than let individual countries respond in isolation.
Industry insights, the latest tech news, and special interviews, all in the Tech Insider Newsletter.
One email a week. No spam, unsubscribe anytime.
Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Inside Advisory AA26-293A: What the Government Disclosed
Advisory AA26-293A follows the now-familiar #StopRansomware format that CISA and the FBI have used for dozens of ransomware groups over the past several years, pairing a threat profile with concrete mitigation steps. According to CISA’s official announcement, the bulletin documents how SafePay ransomware actors gain access, move through networks, and extort victims, giving network defenders specific indicators to watch for rather than generic warnings.
Agencies describe SafePay as having been “highly active” since August 2024, a timeline that places its emergence roughly two years ago. In that window, the group has reportedly compiled the kind of victim count that normally takes a ransomware operation three or four years to accumulate, which is part of why the joint advisory treats it as an urgent, ongoing threat rather than a historical case study.
A Six-Agency, Three-Continent Coalition
The roster of agencies behind AA26-293A is worth dwelling on. Alongside CISA and the FBI, the advisory carries the backing of the U.S. Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK bodies, the National Crime Agency and the North West Regional Organised Crime Unit. Cybersecurity Dive’s coverage of the release frames this breadth of participation as evidence that SafePay’s victim list spans jurisdictions with very different regulatory and law enforcement structures, forcing agencies to coordinate rather than each publish a national-level warning.
You may like
Who Is SafePay? Tracking a Ransomware Group Since August 2024
SafePay ransomware does not appear to be a rebrand of a defunct operation in the way some past groups have reused code and tooling from predecessors. The advisory treats it as a distinct, financially motivated actor that has been operating under its own name since August 2024. Specific details about the individuals or organizational structure behind SafePay remain unconfirmed in the materials released so far, and the advisory itself focuses on observed behavior rather than attribution to a particular country or criminal network.
What the advisory does confirm is a consistent operating pattern: gain a foothold through credentials or software flaws, move laterally using tools that are already present on the victim’s network, locate valuable data, disable defenses, encrypt files, and demand a cryptocurrency payment. That consistency across roughly 600 incidents is what let investigators compile a single advisory instead of treating each breach as a one-off.
The Numbers: 600 Victims Across Four Continents
The headline figure in the SafePay ransomware advisory is approximately 600 victims, a number that multiple outlets have now repeated independently. TechNadu’s report on the advisory confirms the same figure, describing at least 600 organizations hit across multiple critical infrastructure sectors. The affected regions, per the joint advisory, span North America, South America, Europe, and Australia, making SafePay a genuinely global problem rather than a regional nuisance.
What the advisory does not disclose is a sector-by-sector breakdown, specific ransom amounts demanded or paid, or the identities of victim organizations. Those details remain unconfirmed in the public record as of this writing, and any article claiming otherwise should be treated with skepticism until CISA or the FBI confirm the specifics.
How SafePay Breaches Networks: Initial Access Techniques
The advisory lists three primary initial-access methods SafePay actors rely on: compromised or guessed credentials, phishing, and exploitation of vulnerabilities in internet-facing security devices, frequently through VPN services. None of these techniques are novel on their own, but SafePay’s apparent ability to combine them at scale against roughly 600 targets in just over two years points to an operation that has industrialized the early stages of an intrusion.
VPN appliances sitting at the network edge have become a recurring entry point across the ransomware landscape generally, and SafePay’s reliance on the same category of device echoes a pattern security teams have had to defend against repeatedly. Organizations that treat edge devices as “set and forget” infrastructure, rather than assets requiring the same patch discipline as internal servers, are the ones the advisory is most directly warning.
From Foothold to Encryption: The Post-Compromise Playbook
Once inside a network, the advisory describes SafePay actors creating new accounts or taking over existing ones to maintain access, then using legitimate system administration tools already present on the network to move laterally. This “living off the land” approach lets intruders blend into normal network traffic rather than dropping obviously malicious software that might trip an antivirus signature early in the intrusion.
From there, the group identifies valuable files, disables security protections, encrypts data, and demands a cryptocurrency ransom, the advisory states. That sequence mirrors the double-extortion model that has become standard across the ransomware-as-a-service economy over the past several years: steal data before encrypting it, then threaten to leak it regardless of whether the victim pays for a decryption key.
SafePay Advisory AA26-293A at a Glance
DetailInformation Confirmed by the Advisory
Advisory title“#StopRansomware: SafePay Ransomware”
Advisory identifierAA26-293A
Release dateOctober 20, 2026
Issuing agenciesCISA, FBI, USSS, Landeskriminalamt Rheinland-Pfalz, National Crime Agency, North West Regional Organised Crime Unit
Active sinceAugust 2024
Victim countApproximately 600 organizations
Regions affectedNorth America, South America, Europe, Australia
Initial access vectorsCompromised/guessed credentials, phishing, VPN and edge-device exploitation
Core mitigation focusPatching VPNs/firewalls, ICAM, MFA, Zero Trust, offline immutable backups
What FBI and CISA Officials Are Saying
Officials attached their names directly to the warning rather than leaving it as an anonymous bulletin. Chris Butera, Acting Executive Assistant Director for Cybersecurity at CISA, said “public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay Ransomware group,” according to CISA’s press release. Butera added that “with our partners, CISA encourages organizations to review and implement recommended mitigations to include urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised.”
You may like
Brett Leatherman, Assistant Director of the FBI’s Cyber Division, framed the advisory as a direct response to an active threat rather than a retrospective report. “Today, the FBI and our partners are giving network defenders clear, actionable guidance to protect their organizations from one of 2026’s most active ransomware groups,” Leatherman said, per the same CISA release. He also put a number on the scale of the campaign, stating that “SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors.”
Taken together, the two officials’ statements emphasize urgency over alarm: patch known flaws now, verify whether systems are already compromised, and treat SafePay ransomware as an active rather than theoretical risk for any organization running internet-facing VPN infrastructure.
Why Critical Infrastructure Keeps Getting Hit
Critical infrastructure operators, from utilities to healthcare networks to manufacturing plants, remain a favored target for ransomware groups for a straightforward reason: downtime is more expensive and more dangerous for them than for most businesses. The HIPAA Journal’s coverage of the advisory notes that healthcare organizations in particular face pressure to restore systems quickly given the direct patient-safety implications of extended outages, which can push victims toward paying a ransom even when law enforcement advises against it.
That dynamic is compounded by the age of much critical infrastructure IT. Many operators still run VPN concentrators, firewalls, and other edge appliances that were deployed years ago and patched inconsistently since, precisely the kind of internet-facing security devices the SafePay advisory calls out as an entry point. The eMudhra certificate authority compromise reported earlier this cybersecurity cluster coverage on eMudhra’s CA keys cracked illustrated a related problem: trust infrastructure and edge systems that organizations assume are secure by design can turn into single points of failure when a private key or a VPN credential is exposed.
SafePay vs Other Major Ransomware Groups in 2026
SafePay joins a ransomware landscape that has shifted considerably since law enforcement disrupted LockBit’s infrastructure in an international operation in early 2024 and ALPHV/BlackCat largely went dark after an exit scam the same year. Those disruptions left a gap that newer or previously second-tier groups, including Akira and SafePay, have moved to fill. The table below lays out how SafePay compares on the dimensions the joint advisory itself addresses, while flagging where comparative data on other groups is general industry knowledge rather than figures from this specific advisory.
Ransomware GroupStatus as of October 2026Primary Initial AccessLaw Enforcement Action
SafePayActive, subject of AA26-293A advisoryCredential compromise, phishing, VPN/edge-device flawsJoint FBI/CISA/international advisory issued October 20, 2026
LockBitInfrastructure disrupted by law enforcement in 2024Historically credential abuse and public-facing exploitsOperation Cronos takedown, 2024
ALPHV/BlackCatLargely inactive after 2024 exit scamHistorically affiliate-driven access brokersNo single coordinated takedown; activity collapsed after the scam
AkiraActive, known for targeting VPN appliancesVPN and remote-access exploitationOngoing law enforcement tracking, no major 2026 advisory to date
The pattern across all four groups is consistent: VPN and remote-access infrastructure keeps being the weak point, regardless of which specific ransomware brand is exploiting it. That consistency is one reason CISA and the FBI keep issuing #StopRansomware advisories with overlapping mitigation advice rather than treating each group as requiring an entirely separate defense strategy.
Historical Context: From WannaCry to Ransomware-as-a-Service
Ransomware aimed at critical infrastructure is not a new phenomenon, but the business model has changed substantially since global worms like WannaCry and NotPetya caused widespread disruption in 2017 largely by accident, spreading indiscriminately rather than targeting specific victims. Since then, the ransomware economy has professionalized into a ransomware-as-a-service structure, where developers lease out encryption tools and infrastructure to affiliates who handle the actual intrusions, splitting the proceeds.
Read nextPanzer Ransomware Hits 16 Firms as August Sets 997-Attack Record [2026]Cybersecurity · Sep 18
SafePay’s emergence in August 2024 and its climb to roughly 600 victims by late 2026 fits that trajectory: a deliberately targeted operation, going after organizations with the budgets and operational pressure to pay, rather than a worm spreading at random. The joint advisory’s emphasis on VPN exploitation also echoes earlier large-scale campaigns, including the 2023 MOVEit Transfer exploitation wave attributed to the Cl0p group, which likewise relied on a single class of internet-facing software to reach hundreds of victims at once.
Market Impact: What This Means for Cybersecurity Spending
A joint advisory naming 600 victims and six government agencies tends to accelerate budget conversations inside security teams that might otherwise defer a VPN replacement or an identity management overhaul to next fiscal year. Organizations evaluating endpoint detection platforms in the wake of this advisory have been comparing options like the ones covered in tech-insider.org’s CrowdStrike vs Defender vs SentinelOne breakdown, since EDR tooling is one of the layers CISA’s guidance points to for detecting the lateral movement stage of a SafePay-style intrusion.
The advisory’s emphasis on identity and credential access management also lines up with broader 2026 industry trends toward Zero Trust architectures and mandatory multi-factor authentication, both of which the advisory lists explicitly as mitigations. Security teams weighing open-source monitoring options against commercial platforms have also been revisiting comparisons such as Wazuh vs Security Onion vs CrowdSec as they look for ways to detect the kind of living-off-the-land lateral movement SafePay actors reportedly use.
Mitigation Guidance: What CISA Wants Organizations to Do Now
The joint advisory’s mitigation section reads less like abstract best practice and more like a direct response to the specific techniques SafePay has used against its roughly 600 victims. Brandefense’s analysis of the advisory breaks the guidance into patching priorities and access-control priorities, both of which map directly onto the initial-access and lateral-movement techniques described earlier in the bulletin.
For IT and Security Teams
Patch and update systems, with VPNs, firewalls, and other edge devices treated as top priority
Implement identity, credential, and access management (ICAM) policies across the organization
Require multifactor authentication (MFA) for remote access and administrative accounts
Restrict administrative tools and privileges to limit lateral movement if a credential is compromised
Apply Zero Trust network principles rather than assuming internal traffic is inherently safe
Maintain offline, encrypted, immutable backups that ransomware cannot reach or encrypt
For Executives and Boards
Beyond the technical checklist, the advisory’s framing implicitly asks executives to treat SafePay ransomware as a business continuity risk rather than purely an IT problem. Organizations that have already suffered credential-related incidents, such as the Double Counter breach that exposed 28 million Discord accounts, have shown how quickly a single access-control failure can cascade into a large-scale incident once attackers exploit it at scale. Practical steps like deploying hardware-backed authentication, covered in tech-insider.org’s YubiKey setup guide, directly address the credential-compromise entry point the advisory names first.
SafePay Advisory AA26-293A — Quick Reference Checklist
1. Inventory all internet-facing VPNs, firewalls, and edge devices
2. Confirm patch status against currently known exploited vulnerabilities
3. Enforce MFA on all remote-access and privileged accounts
4. Review ICAM policies for stale or shared credentials
5. Restrict use of built-in admin tools (PsExec, WMI, RDP) to approved workflows
6. Verify backups are offline, encrypted, and immutable
7. Conduct forensic triage on edge devices for signs of prior compromise
Predictions: Where SafePay and Ransomware-as-a-Service Go Next
Expect follow-on advisories naming specific exploited CVEs in VPN and firewall products as CISA and the FBI continue investigating SafePay intrusions through 2027.
More critical infrastructure operators, particularly in healthcare and manufacturing, will accelerate MFA and Zero Trust rollouts specifically citing this advisory in internal risk assessments.
Other ransomware-as-a-service operations will likely attempt to fill any gap SafePay leaves if law enforcement pressure intensifies, mirroring how Akira and SafePay rose after LockBit’s 2024 disruption.
International law enforcement coordination of this scale, spanning the US, Germany, and the UK on a single advisory, is likely to become the norm rather than the exception for ransomware groups with cross-border victim pools.
Cybersecurity vendors will use the advisory’s specific language around edge-device exploitation and living-off-the-land lateral movement in marketing for EDR, identity, and Zero Trust products through early 2027.
Frequently Asked Questions About SafePay Ransomware
What is SafePay ransomware?
SafePay ransomware is a financially motivated ransomware operation that the FBI and CISA say has been highly active since August 2024. It breaches organizations through compromised credentials, phishing, and VPN or edge-device vulnerabilities, then encrypts files and demands cryptocurrency payment.
How many victims has SafePay ransomware claimed?
The joint advisory and FBI officials cite approximately 600 victims worldwide, spanning multiple critical infrastructure sectors across North America, South America, Europe, and Australia.
What is advisory AA26-293A?
AA26-293A is the identifier for the joint “#StopRansomware: SafePay Ransomware” advisory released on October 20, 2026, by CISA, the FBI, the U.S. Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency, and the North West Regional Organised Crime Unit.
How does SafePay ransomware gain initial access to networks?
According to the advisory, SafePay actors primarily use compromised or guessed credentials, phishing campaigns, and exploitation of vulnerabilities in internet-facing security devices, frequently through VPN services.
What should organizations do to protect against SafePay ransomware?
CISA recommends patching VPNs, firewalls, and edge devices urgently, implementing identity and credential access management policies, enforcing multifactor authentication, restricting administrative tools, adopting Zero Trust practices, and maintaining offline, encrypted, immutable backups.
Is SafePay ransomware linked to a specific country or group?
The public advisory does not attribute SafePay to a specific nation-state or name individuals behind the operation. Details about the group’s internal structure remain unconfirmed in the materials released so far.
Which sectors has SafePay ransomware targeted?
The advisory describes SafePay as targeting multiple critical infrastructure sectors but does not break down the approximately 600 victims by specific industry in the public release.
How does SafePay compare to other major ransomware groups like LockBit or Akira?
SafePay shares a reliance on VPN and credential-based access with groups like Akira, while LockBit and ALPHV/BlackCat, both disrupted or diminished in 2024, previously dominated the ransomware-as-a-service landscape SafePay has since moved into.
More on this topicCybersecurityCloud ComputingSoftwareAI & Machine LearningTrending nowMeta Ordered to Pay $25B in New Mexico Privacy Case [2026]California ETS Breach: Reports Cite 7M Students [2026]Square Enix’s FFXIV Warning Caps a 4-Breach October [2026]BioWare’s 30-Year Run Ends: EA’s RPG Retreat [2026]Samsung P9 Express for Switch 2 Drops to $59.99 [2026]
Nadia DuboisAI & Innovation EditorNadia Dubois is the AI & Innovation Editor at Tech Insider, where she tracks the rapid evolution of artificial intelligence, from foundation models to real-world enterprise deployment. She previously covered AI and startups for La Tribune and contributed to MIT Technology Review’s European coverage. Nadia specializes in generative AI, AI regulation, and the intersection of technology and European industrial policy. She holds a dual degree in Computational Linguistics and Journalism from Sciences Po Paris.View all articles
The Tech Insider Newsletter
Industry insights, the latest tech news, and special interviews, every week.
One email a week. No spam, unsubscribe anytime.
Click Here For The Original Source.
——————————————————–
