#StopRansomware: SafePay Ransomware Group Targets Global Businesses and Critical Infrastructure
CISA and international partners have issued an advisory detailing the tactics, techniques, and procedures of the SafePay ransomware group, which has impacted over 600 victims globally since August 2024.
A joint cybersecurity advisory from CISA and international partners has detailed the recent activities of the SafePay ransomware group, highlighting its significant global impact since August 2024. The group has targeted businesses and critical infrastructure across North America, South America, Europe, and Australia, affecting at least 600 separate victims across multiple critical infrastructure sectors.
SafePay actors typically gain initial access to victim networks through a variety of methods. These include stealing or guessing passwords, exploiting vulnerabilities in security systems, and employing phishing tactics. Notably, they have been observed using the IP addresses of the VPN provider "Mullvad" for initial access. The group also exploits known vulnerabilities in edge devices, specifically citing CVE-2020-3259 and CVE-2023-20269. Furthermore, they leverage automated scripts to exploit internet-exposed systems, targeting vulnerabilities such as CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
Once inside a network, SafePay actors focus on establishing persistence and maintaining stealth. They achieve this by gaining administrative privileges on existing or newly created accounts, often utilizing built-in administrative tools consistent with "living off the land" (LOTL) techniques. The use of LOTL binaries (LOLBins) like PsExec is common for moving laterally within the network and disabling security protections to avoid detection.
The group's modus operandi involves identifying valuable files, disabling defensive measures, and then encrypting the victim's data, rendering it inaccessible. Following the encryption, they leave a ransom note demanding payment in cryptocurrency for the decryption key.
The advisory emphasizes the importance of implementing robust security measures to mitigate the risk and impact of SafePay ransomware attacks. Key recommendations include regularly patching and updating all systems, particularly firewalls and other edge devices. Organizations are urged to implement Zero Trust principles and restrict administrative tools and privileges to only necessary users.
Strengthening account security through comprehensive identity, credential, and access management (ICAM) policies, coupled with multifactor authentication (MFA), is also a critical defense strategy. The advisory provides a comprehensive list of indicators of compromise (IOCs) and maps the threat actors' observed tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK® framework for detailed analysis by network defenders.
This advisory is part of the ongoing #StopRansomware initiative, aimed at providing network defenders with actionable intelligence on various ransomware variants and threat actors. The information shared, including TTPs and IOCs, is derived from investigations by the FBI, USSS, and Germany's Landeskriminalamt Rheinland-Pfalz, with activity observed as recently as August 2026.
The SafePay ransomware group's significant impact, with over 600 victims identified, underscores the persistent and evolving threat posed by ransomware operations. The joint nature of this advisory, involving multiple international law enforcement and cybersecurity agencies, highlights the global coordination required to combat such widespread cybercrime.