SafePay Ransomware Warning Hits Six Hundred Victims

The SafePay ransomware warning from US and European authorities is a reality check for anyone who thinks hackers only chase giant tech brands. The FBI, the Cybersecurity and Infrastructure Security Agency and partners say the group has hit at least six hundred victims since August of two thousand twenty-four, according to Security Affairs. Hospitals, utilities and businesses sit on that list.

Who issued the SafePay ransomware warning

The joint advisory came from CISA, the FBI, the US Secret Service, Germany's state criminal police office in Rhineland-Palatinate, and two British law enforcement agencies. They describe SafePay as one of the most active ransomware operations running today. The victims span North America, South America, Europe and Australia.

Reuters reported that CISA made the announcement on a Tuesday, with Brett Leatherman, the assistant director of the FBI's cyber division, saying SafePay actors have already targeted more than six hundred victims worldwide across multiple critical infrastructure sectors. The agencies also published technical details in an official CISA advisory so defenders can spot the group's activity.

How SafePay gets inside a network

Nothing about the break-in method is exotic. According to the advisory as summarised by Security Affairs, the group relies on exposed credentials, brute force password guessing and VPN access, and it exploits known flaws in internet-facing devices. Those include older Cisco VPN bugs, a Veeam backup flaw and a SonicWall access issue.

Once inside, the attackers lean on normal administrator tools instead of custom malware. That makes the activity blend in with routine work, which is exactly why it is hard to catch. The agencies say the crew then hunts for shared folders, steals account credentials and uses remote access software to stay connected.

Double extortion, and a phone call

SafePay runs what investigators call a double extortion playbook. First it copies sensitive data, then it locks the systems, then it threatens to post the stolen files publicly if the victim refuses to pay. Reuters noted that in some cases the group even calls victims directly to turn up the pressure.

The advisory adds that the crew deletes shadow copies and resets network backup devices, so a company cannot simply restore its files. Encrypted data cannot be recovered without the decryption key, and CISA warned that paying a ransom does not guarantee anything will come back, as Thailand's national cyber emergency team noted in its summary of the alert.

A group that works without partners

One detail stands out. Security Affairs reports that SafePay appeared in mid-2024 as an independent group that operates without affiliates. Many big ransomware gangs work like franchises, renting their tools to other criminals. SafePay keeps the whole operation in-house, and it grew as better-known gangs such as BlackCat and LockBit declined.

That matters for defenders because a tight-knit crew is more consistent. The same habits show up again and again across victims, which is why the published indicators are valuable. The advisory includes machine-readable files, a full mapping to the MITRE ATT&CK framework and lists of file and network clues.

Timing adds to the concern. The advisory draws on investigations by the FBI, the Secret Service and German authorities that run through August of this year, so the picture is current rather than historical. When several countries publish a shared alert, it usually means the same crew is hitting targets in many places at once and that no single border contains the problem.

The SafePay ransomware warning also lands in a week packed with security alerts. CISA added fresh entries to its list of actively exploited flaws and urged urgent patching of critical bugs in a popular web programming language, according to Daily CISO. For smaller organisations with thin IT teams, the pile of notices can feel impossible to keep up with, and attackers count on exactly that fatigue.

What organisations are told to do

The recommendations read like a checklist most teams already know and often skip. Keep VPNs and firewalls updated, and patch the flaws already listed in CISA's catalog of known exploited vulnerabilities first. Turn on multi-factor authentication for VPNs, webmail and anything that touches critical systems.

Limit who can use administrator tools, review accounts with special privileges, and keep backups offline, encrypted and unchangeable so attackers cannot touch them. If an attack does land, victims are urged to report it to law enforcement.

Why this one is worth a Gen Z look

Ransomware can feel like a corporate problem, but it reaches school boards, clinics and local services, the places that hold student records and medical files. Strong, unique passwords and app-based sign-in codes protect personal accounts in the same way they protect a hospital network. More coverage of online threats lives on the tech desk at GenZ NewZ, and the bigger picture is on the world desk.

The takeaway of the SafePay ransomware warning is simple: the doors attackers use are usually old, known and fixable. The question for every organisation is whether somebody has actually closed them.