FBI and allies warn SafePay ransomware group has hit 600 organizations since 2024

Federal authorities and allied law enforcement agencies in Germany and the United Kingdom warned Tuesday that a ransomware group known as SafePay has breached at least 600 organizations across North America, South America, Europe and Australia since August 2024, making it one of the most active extortion operations of the past year. The joint cybersecurity advisory, issued by the FBI, the Cybersecurity and Infrastructure Security Agency, the U.S. Secret Service, a German state criminal police office and two British law enforcement units, described SafePay as targeting businesses and critical infrastructure with a mix of stolen credentials, exploited software flaws and phishing emails.

The advisory, catalogued as AA26-293A, is the latest in a series of so-called #StopRansomware bulletins that U.S. agencies issue jointly with international partners to publicize technical details of active threats. It lands at a moment when ransomware crews continue to hit hospitals, school districts, local governments and government contractors largely unabated despite years of law enforcement takedowns, sanctions and arrests aimed at the broader cybercrime ecosystem.

How SafePay breaks in

According to the advisory, SafePay's operators typically gain initial access by guessing or buying stolen passwords, exploiting known vulnerabilities in internet-facing systems, or sending phishing emails. The advisory lists several specific flaws the group has exploited, including CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, all of which already appear on CISA's Known Exploited Vulnerabilities catalog. Once inside a network, the group creates new user accounts or hijacks existing ones, then relies on legitimate administrative tools such as PsExec, WinRM and Remote Desktop Protocol to move laterally rather than deploying custom malware that might draw attention.

From there, the advisory says, SafePay's operators disable security software, use commercial tools such as RClone and WinSCP to copy out sensitive files, and only then deploy an encryptor that appends the extension ".SafePay" to locked files. To complicate recovery, the group also halts the Windows Volume Shadow Copy Service, which many organizations rely on for quick file restoration, and resets network-attached storage backup devices to their factory settings. Victims who don't pay are told their stolen data will be published on a leak site, and the advisory notes that the group follows up its ransom notes with direct phone calls rather than relying on messages alone.

"To put pressure on the victim, a representative makes phone calls on behalf of the ransomware group," the advisory states, describing how SafePay demands "a subset of company revenue in cryptocurrency" rather than a flat ransom figure.

Security researchers cited in the advisory and in independent reporting have noted that parts of SafePay's encryptor code resemble LockBit, the once-dominant ransomware franchise that international police dismantled in 2024, suggesting at least some reuse of leaked or purchased criminal tooling rather than an entirely new codebase, as The Record reported.

From IT distributors to Medicaid payment systems

The 600-victim figure is abstract, but SafePay's recent claimed targets illustrate how far a single ransomware operation's reach can extend into everyday infrastructure. The group has taken credit for attacks this year on Ingram Micro, one of the largest distributors of IT hardware and software in the United States, and on Microlise, a British company whose software tracks commercial vehicle fleets. Its highest-impact claimed victim may be Conduent, a government technology contractor whose systems support Medicaid claims processing, child-support payments, food-assistance benefits and electronic road-toll collection in multiple U.S. states. The disruption to Conduent's systems was severe enough that the company agreed to an $80 million settlement, reported last week, to resolve a class-action lawsuit brought by people affected by the breach, according to Information Security Media Group.

That spread of victims across IT supply chains, logistics software and government benefit systems is precisely what prompted the multinational advisory: ransomware that starts inside one company's network can end up delaying food-assistance payments or child-support checks to people who have no direct relationship with the hacked organization at all. The advisory describes its intended audience broadly, naming federal civilian agencies, state, local, tribal and territorial governments, and critical infrastructure operators, along with the security staff inside those organizations who are responsible for patching systems and watching network traffic.

A pattern that keeps repeating

The SafePay advisory is the latest entry in a long-running series of joint ransomware warnings CISA has issued with the FBI and international partners over the past several years, covering groups such as Medusa and Interlock that are still listed as active threats on the agency's StopRansomware portal, the government's central hub for ransomware guidance and incident reporting. The repeated pattern, a joint advisory naming a group's tactics and known vulnerabilities, followed months or years later by another advisory naming a successor group using similar methods, has become a familiar rhythm in ransomware coverage even as the underlying problem, organizations failing to patch internet-facing systems quickly or maintain tested offline backups, remains largely unchanged.

For the companies and government bodies named in connection with SafePay's campaign, the fallout has already extended well beyond the initial intrusion. Conduent's settlement shows how a single ransomware incident at a government contractor can generate years of litigation and payouts long after the attackers have moved on to new targets, and the advisory's broad list of likely victims, spanning IT distribution, commercial trucking software and state benefit programs, suggests the full accounting of SafePay's impact is still incomplete.

What defenders are being told to do next

The advisory's recommendations are largely familiar to security teams but are notable for how specifically they target the techniques SafePay has actually used, rather than offering generic advice:

• Prioritize patching internet-facing devices, especially firewalls, VPN gateways and other edge equipment, against known exploited vulnerabilities
• Require multifactor authentication for VPNs, webmail and other remote-access and critical-system accounts
• Maintain offline, encrypted and immutable backups, and regularly test restoring from them
• Segment networks to limit how far an intruder can move after an initial compromise
• Audit administrative accounts and apply least-privilege and just-in-time access policies
• Monitor for the specific legitimate tools, such as PsExec, RClone and WinSCP, that SafePay has repurposed for its attacks

No arrests, sanctions or infrastructure seizures were announced alongside the advisory, and the agencies did not say whether any SafePay members had been identified. That stands in contrast to the broader law-enforcement push against LockBit, whose leadership and servers were targeted directly in an international takedown operation. For now, the public guidance is aimed squarely at potential victims rather than at disrupting the group itself, and the agencies that signed the advisory are directing organizations that believe they have been compromised to report the incident to the FBI's Internet Crime Complaint Center or a Secret Service field office, or to request technical assistance directly from CISA.

Whether this advisory slows SafePay's pace is an open question; similar joint warnings about other ransomware families in recent years have sometimes coincided with a group rebranding or splintering rather than disappearing outright. Security researchers say they will be watching SafePay's leak site and its targeting patterns in the coming weeks for any sign that the publicity, or quiet law-enforcement pressure behind the scenes, is having an effect on a group that, for now, shows no public indication of slowing down.