CISA, FBI and European police warn SafePay ransomware has hit at least 600 critical-infrastructure organizations
The joint advisory lists how SafePay gets in and what defenders should lock down first.
CISA, the FBI, the U.S. Secret Service and partners in Germany and the UK released a joint advisory on October 20 about SafePay, which CISA calls one of the most active ransomware groups. It says SafePay has affected businesses and critical infrastructure in North America, South America, Europe and Australia, including at least 600 critical-infrastructure organizations since August 2024.
The advisory says SafePay gets in through exposed credentials, brute-force password attacks and VPN access, particularly from IP addresses of the VPN provider Mullvad, and by exploiting known flaws in edge devices. BleepingComputer adds that SafePay works without affiliates, steals data before encrypting it and threatens to leak it, and may delete shadow copies and reset backup storage to hamper recovery.
The agencies recommend multifactor authentication, limiting admin tools and privileges, and patching VPNs, firewalls and other edge devices, and say paying a ransom does not guarantee files come back.
-
Ransomware
After exploring CISA: SafePay ransomware hit over 600 critical infrastructure orgs, the basics of the threat are in Ransomware.
An overview of malware that holds data hostage until a ransom is paid, through encryption, theft with a threat to publish, or both.
Wikipedia · Wade · 5 min
0