FBI, CISA and International Partners Issue Alert Over SafePay Ransomware Surge

Federal authorities and several European law‑enforcement bodies have jointly warned that the SafePay ransomware strain has compromised more than 600 organizations worldwide since early 2024, marking it as one of the most pervasive threats of the year.

According to the joint advisory, attackers behind SafePay rely heavily on stolen user credentials and unsecured VPN gateways to infiltrate target networks. Once inside, they deploy encryption payloads and then employ a double‑extortion tactic: not only do they lock files, they also threaten to release sensitive data publicly unless a ransom is paid.

The warning was issued by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in coordination with the Federal Bureau of Investigation, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland‑Pfalz, and two law‑enforcement agencies in the United Kingdom. All parties emphasized that the campaign remains active and that victims are being pressured to comply quickly.

SafePay’s rapid spread reflects broader trends in ransomware operations, where threat actors increasingly exploit remote‑access tools and compromised credentials rather than relying solely on phishing attachments. The shift underscores the importance of robust identity‑and‑access management, multi‑factor authentication, and regular review of VPN configurations.

Officials advised organizations to assume that any exposed VPN endpoint could be a potential entry point for the malware. They also recommended immediate steps such as disabling unused accounts, enforcing strong password policies, and conducting comprehensive network segmentation to limit lateral movement should an intrusion occur.

While the advisory did not disclose specific victims, the sheer number of affected entities suggests that sectors ranging from healthcare to manufacturing may be at risk. Experts caution that the financial and reputational fallout from a successful SafePay attack can be severe, especially when stolen data is leaked alongside encrypted files. Ongoing investigations aim to trace the ransomware operators, but the multinational nature of the campaign complicates attribution.

Authorities have pledged continued collaboration across borders to disrupt the group behind SafePay. In the meantime, cybersecurity professionals are urged to monitor network traffic for anomalous VPN usage and to maintain up‑to‑date backups that are stored offline, reducing the leverage attackers have over compromised organizations.