CISA issued a joint cybersecurity advisory exposing the threat from SafePay ransomware group, which has compromised infrastructure organisations globally using living-off-the-land tactics and double-extortion phone calls.
The advisory warns network defenders of SafePay, identified as one of the most active ransomware groups of 2026, which has compromised approximately 600 victim organisations worldwide across multiple critical infrastructure sectors in the Americas, Europe, and Australia.
Threat actors primarily gain initial entry into victim networks by compromising credentials and exploiting known vulnerabilities in internet-facing edge appliances, frequently connecting through VPN – virtual private – networks.
Actors leverage legitimate IT utilities and dual-purpose tools to move laterally through victim infrastructure while avoiding detection.
SafePay systematically undermines recovery efforts by deleting, disabling, or resetting backup systems before executing system-wide data encryption.
“Public-facing devices with known vulnerabilities continue to be frequently targeted by threat actors like SafePay Ransomware group,” said Acting Executive Assistant Director for Cybersecurity, Chris Butera. “With our partners, CISA encourages organizations to review and implement recommended mitigations to include urgently patching the known exploited vulnerabilities in this advisory and conducting forensic triage to determine if systems have been compromised.”
“Today, the FBI and our partners are giving network defenders clear, actionable guidance to protect their organizations from one of 2026’s most active ransomware groups,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors. By following these recommendations, network defenders can significantly reduce both the likelihood and the impact of a SafePay ransomware attack.”
Identity Week Europe sessions dedicated to physical access control systems and operational technology explore bridging identity management across physical security and network defences.
