CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors

CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), U.S. Secret Service (USSS), and international partners released a joint Cybersecurity Advisory, #StopRansomware: SafePay Ransomware, that warns organizations of one of the most active ransomware group in 2026, impacting approximately 600 victims across sectors in the Americas, Europe and Australia. To help organizations protect against this group, the advisory provides observed tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs) and recommended mitigations. SafePay actors gain access to victim networks by compromising credentials and targeting known vulnerabilities in internet-facing devices, often connecting through virtual private network (VPN) services. Once inside, they use legitimate IT tools to move through networks and undermine recovery by deleting or disabling backups. They then steal data and encrypt systems, pressuring victims to pay by threatening to publish stolen information and, in some cases, calling victims directly. “Public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay Ransomware group,” said Acting Executive Assistant Director for Cybersecurity, Chris Butera. “With our partners, CISA encourages organizations to review and implement recommended mitigations to include urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised.” “Today, the FBI and our partners are giving network defenders clear, actionable guidance to protect their organizations from one of 2026’s most active ransomware groups,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors. By following these recommendations, network defenders can significantly reduce both the likelihood and the impact of a SafePay ransomware attack.” To protect against the SafePay ransomware group, CISA, FBI, USSS and international partners urge organizations to review the advisory and implement recommended mitigations such as: - Keep all operating systems, software, and firmware up to date. - Require multifactor authentication. - Prioritize patching known exploited vulnerabilities in internet-facing systems. - Maintain offline backups of data and regularly test restoration processes. - Segment networks to prevent threat actors from spreading ransomware. For more information, please visit Stop Ransomware. ### About CISA As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to manage, uncover, and reduce risk to our digital and physical infrastructure Americans rely on every hour of every day. Visit CISA.gov for more information and follow us on X, Facebook, LinkedIn, Instagram.