CISA and FBI warn SafePay ransomware has hit over 600 critical infrastructure organisations
A joint advisory tracked as AA26-293A warns SafePay has breached more than 600 organisations in critical infrastructure sectors worldwide since August 2024, making it one of the most active ransomware operations of 2026.
A joint cybersecurity advisory issued on Tuesday has warned that the SafePay ransomware group has breached more than 600 organisations in critical infrastructure sectors worldwide since August 2024, BleepingComputer reported.
The advisory, tracked as AA26-293A, was published by the US Cybersecurity and Infrastructure Security Agency (CISA) together with the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency and the UK’s North West Regional Organised Crime Unit.
“SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors,” said Brett Leatherman, assistant director of the FBI’s cyber division, Reuters reported.
Investigators say SafePay is one of the most active ransomware operations of 2026, with victims across North America, South America, Europe and Australia. The group emerged in August 2024 as a private operation that does not work with affiliates, and its intrusions were still being observed as recently as August 2026.
SafePay gains initial access through exposed or phished credentials, brute-force password attacks and VPN exploitation — including IP addresses belonging to VPN provider Mullvad. It also exploits five known flaws affecting firewall, VPN and backup products: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
The agencies warned that paying a ransom does not guarantee file recovery and urged victims to report incidents to law enforcement. SafePay steals sensitive documents before encrypting systems and threatens to publish the data; only victims who do not pay appear on its leak site. Recommended defences include multifactor authentication, restricting administrative tools to block lateral movement, and patching edge devices listed in CISA’s known-exploited-vulnerabilities catalogue.
Read next
More on this topic: all Technology stories
