Threat Pulse 62High
CISA, FBI and partners issue SafePay ransomware advisory: 600+ victims since 2024
Severity 6ActiveconfirmedGovernmentHealthcare

Joint advisory AA26-293A details SafePay, which has hit at least 600 organizations across critical infrastructure in the Americas, Europe and Australia. The group gets in through exposed credentials, brute force, VPN abuse and scripted exploitation of edge-device CVEs, deletes shadow copies, resets backup storage and phones victims during double extortion.

What to do: Advisory includes IOCs and hardening steps; campaign ongoing.

· 15 days ago · at least 600 organizations · CISA bulletin
SourcesCISA bulletincisa.govcisa.gov
On X
@CISAgovverifiedOct 20, 18:56 UTC

We’ve released a new advisory w/ @FBI, @SecretService & partners to help orgs detect + defend against prolific SafePay ransomware activity targeting businesses & multiple #CriticalInfrastructure sectors worldwide

Open on X
@CISACyberverifiedOct 20, 18:57 UTC

SafePay ransomware has affected 600+ #CriticalInfrastructure orgs since 2024. Read our new advisory w/@FBI @SecretService & partners for IOCs + mitigations, including: patch edge devices, limit admin access & enf

Open on X
Why this score

Hundreds of organizations (impact 2), ongoing mass intrusions (exploitability 3), multiple critical sectors (criticality 1).

Back to the board

Updated Nov 5, 01:48 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.