The FBI, CISA, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz and the United Kingdom’s National Crime Agency have issued a joint #StopRansomware advisory on SafePay, a ransomware operation active since August 2024 that combines data theft with encryption to pressure victims into paying, and which the agencies say has affected at least 600 victims across critical infrastructure sectors. The advisory says the group typically gains access by stealing or guessing passwords, brute-force attacks, phishing and exploiting VPN services, moves laterally with standard attacker tooling, and exfiltrates data before deploying its encryptor. It urges organisations to require multifactor authentication, prioritise patching known exploited vulnerabilities in internet-facing systems, and maintain offline, encrypted backups that are regularly tested.
CISA and partners publish SafePay ransomware advisory
The FBI, CISA, the US Secret Service and German and British law-enforcement agencies have published a joint advisory on SafePay, a double-extortion ransomware operation that has hit at least 600 victims since August 2024, setting out its intrusion methods and recommended mitigations for network defenders.
Why it matters: SafePay steals data before encrypting systems and threatens publication to force payment, and the advisory gives organisations a shared, current picture of how the group gets in, chiefly through phished credentials and exposed remote access services.
Data as of CISA joint advisory AA26-293A, October 20, 2026, read in full. Developing item.
Sources
- #StopRansomware: SafePay Ransomware (AA26-293A) - US Cybersecurity and Infrastructure Security Agency (CISA) - 2026-10-20