#ransomware

CISA, the FBI, the U.S. Secret Service and partners in Germany and the UK released a joint advisory on October 20 about SafePay, which CISA calls one of the most active ransomware groups. It says SafePay has affected businesses and critical infrastructure in North America, South America, Europe and Australia, including at least 600 critical-infrastructure organizations since August 2024.

The advisory says SafePay gets in through exposed credentials, brute-force password attacks and VPN access, particularly from IP addresses of the VPN provider Mullvad, and by exploiting known flaws in edge devices. BleepingComputer adds that SafePay works without affiliates, steals data before encrypting it and threatens to leak it, and may delete shadow copies and reset backup storage to hamper recovery.

The agencies recommend multifactor authentication, limiting admin tools and privileges, and patching VPNs, firewalls and other edge devices, and say paying a ransom does not guarantee files come back.

The FBI warns that attacks using the FortiBleed credentials leak are ongoing against exposed Fortinet FortiGate firewalls and SSL VPN gateways. Attackers log in with leaked or stolen credentials, crack further password hashes offline, and in some cases create their own admin accounts and delete or change the legitimate ones. The FBI says the attack chain has been an entry point for ransomware affiliates. It says fixing this may take more than patching and resetting passwords: restrict external access, end all active VPN sessions, enforce MFA and review logs.

IDC Frontier, a SoftBank Group subsidiary, says a ransomware attack that began at 3:40 a.m. on October 7 stopped virtual servers in four zones of its IDCF Cloud East Japan Region 1. It says 495 companies and local governments are affected. In its third update, the company says customer data stored in those zones is unlikely to be recoverable, so customers will have to restore from their own backups; it is advising customers in other regions to back up their data too. The attacker claims to have encrypted 225 databases and wiped more than 550,000 snapshots, BleepingComputer reports; those figures are the attacker's.

A public feud erupted between ShinyHunters and Clop, with ShinyHunters claiming it exploited a vulnerability to seize Clop's dark-web leak site.

Reuters reported that the dispute involved accusations around a stolen zero-day exploit and threats to expose rivals' identities or operational details.

Why it matters

Cybercrime groups depend on reputation, infrastructure, access brokers and shared exploit ecosystems. Open conflict between major actors can expose internal relationships and may disrupt criminal operations—or simply push them to rebuild with stronger operational security.