The Cybersecurity and Infrastructure Security Agency issued an advisory describing SafePay ransomware activity against businesses and critical infrastructure in the Americas, Europe and Australia, noting that the group has been highly active since August 2024. The advisory describes entry methods involving stolen or guessed passwords, security-system vulnerabilities and phishing, followed by account creation or takeover and use of legitimate tools to traverse networks, locate valuable files and disable protections.
OriginalquelleJournal · Cybersecurity and Infrastructure Security Agency
#StopRansomware: SafePay Ransomware
<h2><strong>Advisory at a Glance</strong></h2> <table> <tbody> <tr> <th>Title</th> <td>#StopRansomware: SafePay Ransomware</td> </tr> <tr> <th>Original Publication </th> <td>October 20, 2026</td> </tr> <tr> <th>Executive Summary</th> <td> <p>This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. </p> <p>Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to a