The SafePay ransomware group has breached more than 600 organizations across the United States and Europe since August 2024, as reported in a recent advisory from international law enforcement agencies including the FBI, Germany, and the UK. Recognized as one of the most active ransomware groups in 2026, SafePay targets businesses and critical infrastructure through methods such as password guessing, vulnerability exploitation, and phishing attacks.

Investigations by the FBI and German law enforcement have revealed the group's use of several vulnerabilities in their attacks, including CVE-2020-3259 and CVE-2023-20269, among others. Once inside a network, SafePay operators establish control by creating or taking over accounts. They utilize legitimate system tools to navigate the network, identify valuable files, and disable security measures to avoid detection.

The group is known to employ automated scripts to exploit internet-exposed system vulnerabilities and sometimes changes user passwords to obstruct login attempts. Before deploying ransomware, they compress and exfiltrate files using legitimate remote desktop tools like AnyDesk or TeamViewer. SafePay typically demands a portion of a company's revenue in cryptocurrency for the decryption key. To exert additional pressure, group representatives may contact victims by phone.

SafePay's leak site currently lists numerous German companies and government organizations across Latin America and the US. Experts have noted similarities between SafePay's code and that of LockBit, a now largely inactive ransomware operation. Recent attacks include those on a major US IT provider, British tech firm Microlise, and government technology contractor Conduent. The attack on Conduent notably disrupted services related to Medicaid, child support, food assistance, and more in the US, leading to an $80 million settlement following a class action lawsuit.