US Agencies Identify 600 Victims Of Safepay Ransomware Arabian Post

(MENAFN- The Arabian Post) clearfix"> US cybersecurity authorities have warned that SafePay ransomware operators have compromised at least 600 organisations worldwide, including critical infrastructure providers, and urged businesses to strengthen network defences against further attacks.

The Cybersecurity and Infrastructure Security Agency (CISA) issued the joint advisory on Tuesday alongside the Federal Bureau of Investigation, US Secret Service and law enforcement partners in Britain and Germany. It describes SafePay as one of the most active ransomware groups of 2026.

The tally covers victims identified since August 2024 across North America, South America, Europe and Australia. Authorities did not specify how many of the 600 organisations belonged to each critical infrastructure sector or disclose a comprehensive breakdown by country.

The warning draws on investigations by the FBI, Secret Service and Germany's Rheinland-Pfalz state criminal police, including activity examined through August 2026. It provides technical indicators intended to help security teams detect intrusions and limit damage.

“SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors,” said Brett Leatherman, assistant director of the FBI's Cyber Division. He urged network defenders to implement the agencies' recommendations to reduce the likelihood and impact of attacks.

SafePay attackers frequently enter corporate networks through stolen or exposed credentials, password guessing and vulnerabilities in internet-facing equipment. Virtual private network connections are a particular concern, with investigators identifying activity involving IP addresses associated with the Mullvad VPN service.

The advisory also describes phishing and automated exploitation of weaknesses in edge devices, including systems used to connect internal networks to the internet. Such entry points can allow attackers to bypass conventional protections when software patches or access controls are inadequate.

See also Google identifies China-linked exploitation of BeyondTrust security flaw

Once inside, operators seek administrative privileges by taking over existing accounts or creating new ones. They use legitimate management utilities, including PsExec and Windows Remote Management, to execute commands and move between connected machines, making malicious activity harder to distinguish from routine administration.

Investigators have also observed the use of remote desktop connections and commercial remote management software. Attackers may disable security products, alter account credentials and deploy techniques designed to conceal malicious code while searching for valuable information.

Before encrypting files, the group typically collects sensitive material and transfers it to infrastructure under its control. The advisory identifies widely available tools, including FileZilla, 7-Zip, WinRAR and RClone, among software used during data collection and extraction.

SafePay then applies a double-extortion strategy, combining disruption of computer systems with threats to publish stolen information. Victims generally receive ransom instructions directing them to an encrypted communications portal, where payments are demanded in cryptocurrency.

Authorities say operators sometimes telephone victims to intensify pressure. Refusal to pay can lead to stolen information being posted on the group's leak website, although the appearance of an organisation on such a site does not independently establish every claim made by attackers.

Recovery can become more difficult because SafePay operators delete Windows shadow copies and reset network-attached storage devices holding backups. These actions can deprive organisations of accessible recovery points after systems have been encrypted.

CISA urged organisations to prioritise patches for vulnerabilities known to be exploited, particularly those affecting firewalls, VPN equipment and other externally accessible devices. It also recommended multifactor authentication, stronger identity management and restrictions on administrative privileges.

See also UK and allies expose Integrity Tech cyber operations

The agencies advised businesses to maintain offline, encrypted and immutable backups, test restoration procedures and separate network segments to constrain an intruder's movement. Monitoring for unusual administrative activity and investigating suspicious connections were identified as further safeguards.

Security company NCC Group identified SafePay as the most active ransomware operation in May, recording 70 attacks claimed by the group. Such figures reflect publicly observed or claimed incidents and are not necessarily equivalent to independently confirmed compromises.

SafePay has also been linked to attacks affecting technology distribution and business services. The group claimed responsibility for an intrusion involving Ingram Micro in 2025, when the company experienced disruption to order processing and subsequently disclosed the theft of personal information.

The joint advisory includes indicators of compromise in machine-readable formats for security teams. Its participating authorities include Britain's National Crime Agency and North West Regional Organised Crime Unit, alongside Germany's Rheinland-Pfalz investigators.

MENAFN22102026000152002308ID1111848543