FBI Warns SafePay Ransomware Has Hit 600+ Organizations: Here’s What We Know

SafePay ransomware has affected at least 600 organizations across multiple critical infrastructure sectors since August 2024, according to a new federal warning detailing the group's attacks on corporate networks.

The FBI, Cybersecurity and Infrastructure Security Agency (CISA), US Secret Service, and international partners issued a joint cybersecurity advisory on Oct. 20 detailing the threat. Authorities describe SafePay as one of the most active ransomware groups, with operations affecting businesses and critical infrastructure across several continents.

The warning highlights a troubling reality for security teams: Attackers can exploit familiar security weaknesses to compromise corporate networks, steal sensitive information, and undermine the systems organizations depend on for recovery.

How SafePay ransomware attacks organizations

According to the advisory, SafePay has affected organizations across North America, South America, Europe, and Australia. The warning draws on investigations conducted by U.S. authorities and international partners, including agencies in Germany and the United Kingdom.

Investigators identified several initial-access methods, including exposed credentials, brute-force password attacks, compromised accounts obtained through phishing, and exploitation of vulnerabilities in VPNs and other internet-facing systems.

Investigators identified SafePay activity associated with IP addresses linked to Mullvad VPN. They also documented the use of compromised accounts obtained through phishing to access victim networks. The findings do not indicate that Mullvad itself was breached.

The advisory identifies five vulnerabilities linked to SafePay's initial-access activity. Two affect Cisco ASA and FTD products and are discussed alongside the group's use of compromised accounts and VPN access. Investigators also observed attackers using automated scripts to exploit three additional vulnerabilities affecting Veeam Backup & Replication and SonicWall SonicOS. Additional technical details appear in CISA's full SafePay advisory.

These vulnerabilities are among the weaknesses highlighted in the advisory, rather than an exhaustive list of potential SafePay attack paths. Security teams should check affected deployments against vendor advisories and apply the appropriate security updates.

These attack methods reflect broader weaknesses in enterprise remote-access security. As eSecurityPlanet previously reported, exposed VPN services, weak credentials, and insufficient access controls can create opportunities for ransomware operators.

Once inside a network, SafePay operators have used compromised accounts and legitimate administrative tools to establish additional access, move laterally, steal sensitive information, and interfere with recovery systems.

The group employs a double-extortion strategy. Attackers steal data before encrypting files, then threaten to publish the information if victims refuse to pay. According to the agencies, SafePay operators have deleted Windows shadow copies and reset network-attached storage devices containing backups, potentially making recovery more difficult for affected organizations.

The warning builds on earlier research into the group's operations. In January, eSecurityPlanet reported on Flare's analysis of SafePay leak data, which highlighted the group's targeting of small and midsize businesses.

The new federal advisory provides a broader picture of SafePay's operations, including investigative findings, known attack techniques, indicators of compromise, and recommended defensive measures.

What security teams should do to prevent SafePay attacks

The FBI and CISA recommend that organizations prioritize patching vulnerable systems, strengthening identity and access management, and restricting administrative privileges.

Security teams should focus on three measures highlighted in the federal announcement:

• Patch vulnerable systems: Regularly update VPNs, firewalls, and other internet-facing devices, prioritizing those with known active exploits.
• Strengthen account security: Implement multifactor authentication and identity, credential, and access management policies. Review privileged accounts and investigate suspicious authentication attempts.
• Restrict administrative privileges: Limit administrative tools and permissions to personnel who require them, reducing opportunities for attackers to move laterally or disable security controls.

Beyond those recommendations, SafePay's documented attacks on recovery infrastructure make backup protection another important precaution.

Organizations should maintain isolated or immutable copies of critical data, restrict access to backup management systems, and regularly test restoration procedures. These practices can reduce damage if attackers delete Windows shadow copies or reset network-attached storage devices that contain backups.

Additional guidance is available in eSecurityPlanet's ransomware backup protection guide.

Security teams should also monitor for unauthorized accounts, suspicious remote-management activity, and unexpected data transfers.

These precautions are especially important because SafePay attackers have used legitimate administrative utilities after gaining access, potentially making malicious activity harder to distinguish from routine IT operations.

The federal advisory includes indicators of compromise and attack techniques that defenders can use to improve detection rules and investigate potentially affected systems.

Organizations should also prepare for attacks that combine data theft with encryption. Restoring files from backups may help restore operations, but it does not eliminate the risk of exposed stolen information.

For organizations managing critical infrastructure or sensitive customer data, the immediate priority is to identify exposed entry points, address known vulnerabilities, restrict unnecessary administrative access, and verify that recovery systems cannot be easily disabled.

With at least 600 organizations affected since August 2024, the SafePay advisory demonstrates how familiar security weaknesses can contribute to a widespread ransomware campaign. Closing vulnerable access paths, limiting privileged access, and protecting backups remain essential steps toward preventing a single compromised account from becoming an organization-wide crisis.

Also read: For more on defending against similar threats, read eSecurityPlanet's ransomware prevention guide for practical steps to protect networks, secure backups, and limit the damage of an attack.