SafePay, a ransomware group, has compromised more than 600 critical infrastructure organizations globally. This alarming information comes from a joint advisory by cybersecurity agencies in the US, Germany, and the UK, including the US Cybersecurity and Infrastructure Security Agency (CISA). Since its emergence in August 2024, SafePay has affected businesses across North America, South America, Europe, and Australia. The group has been particularly active in 2026, ranking third among ransomware groups for activity in the early months of that year, with a notable focus on Germany.

SafePay employs a wide range of tactics for both initial access and operations post-compromise. These include credential exposure, brute force password attacks, exploiting VPN access, and targeting vulnerabilities in edge device products. Once inside a network, SafePay attempts to escalate privileges and move laterally using tools like PsExec, WinRM, and remote management software, often disabling security measures to avoid detection.

The group is notorious for its double extortion approach. After exfiltrating data using legitimate file transfer tools such as FileZilla and OneDrive, they encrypt victim files with a combination of ChaCha20 and RSA encryption. SafePay then demands cryptocurrency payments, typically a portion of the company's revenue, in exchange for decryption keys. They exert additional pressure by contacting victims directly and threatening to publish stolen data if their demands are not met.

CISA's advisory, released on October 20, outlines mitigation strategies to counter SafePay's tactics, techniques, and procedures. Organizations are urged to bolster their defenses to combat this pervasive threat.