FBI, CISA: SafePay Hit 600+ Critical Infra Orgs

Joint advisory out. FBI, CISA, and cyber agencies in the UK and Germany have confirmed that SafePay ransomware has breached more than 600 critical infrastructure organizations worldwide since it emerged in 2024. The advisory describes SafePay as “among the most active” ransomware groups currently operating.

Confirmed access methods per the advisory: credential guessing (brute force and credential stuffing against externally facing services), phishing, and exploitation of known vulnerabilities in unpatched systems. Sectors hit include healthcare, manufacturing, education, and government entities across multiple countries.

The advisory is attributed to CISA, the FBI, the UK National Cyber Security Centre (NCSC), and Germany’s Federal Office for Information Security (BSI). BleepingComputer and The Record both report on the advisory, which was released October 21, 2026.

The 600-victim count is from the advisory itself. Attribution confidence: high (FBI/CISA primary source).

What the advisory says

SafePay operators gain initial access through internet-facing systems. The group has used valid accounts obtained through credential theft alongside exploitation of unpatched flaws to establish footholds before moving laterally. The advisory does not name specific CVEs exploited.

Indicators of compromise and recommended network mitigations are included in the full advisory, available via CISA’s website.

Context

SafePay does not appear to operate a public leak site, which distinguishes it from groups like Qilin. The group has kept a low public profile despite the volume of confirmed intrusions. The 600-victim figure puts it in the same scale range as established ransomware brands that command much more public attention.

A ransomware consultant’s arrest earlier this month (reported here) and the arrest of ShinyHunters suspects (covered here) reflect ongoing federal pressure on the ransomware ecosystem. SafePay is now explicitly named in an enforcement-oriented advisory, which historically increases scrutiny on affiliated infrastructure.

The full advisory, including IOCs and mitigations, is at cisa.gov.