SafePay ransomware affected at least 600 organizations

A joint advisory from U.S. and international law-enforcement agencies says the SafePay ransomware group has affected at least 600 organizations across multiple critical-infrastructure sectors since August 2024. The findings, based on investigations through August 2026, describe attacks combining data theft and file encryption, with some incidents involving efforts to disrupt victims’ backups and recovery systems. The advisory was issued October 20 by the Cybersecurity and Infrastructure Security Agency, the FBI, the U.S. Secret Service and law-enforcement partners in Germany and the United Kingdom. It describes victims across the Americas, Europe and Australia. The agencies characterize SafePay as among the most active ransomware groups in 2026. According to the advisory, attackers gain access through compromised credentials, phishing, brute-force attempts and vulnerabilities in internet-facing systems. They may create new accounts or take control of existing ones, then use legitimate administrative tools to move through networks and identify files of value. The advisory lists several exploited vulnerabilities, including flaws affecting access controls and remote code...