FBI Labels SafePay Ransomware Group Among Most Active, Cites Over 600 Victims Since 2024

The Federal Bureau of Investigation, together with cyber‑security agencies in the United Kingdom and Germany, has identified the SafePay ransomware operation as one of the most prolific threat groups active this year, linking it to more than 600 reported attacks since the start of 2024.

In a coordinated advisory, the three agencies outlined the tactics the gang employs: large‑scale password‑guessing attempts, exploitation of known software flaws, and phishing campaigns that lure users into revealing credentials.

Victims span a broad spectrum of industries, from manufacturing and logistics firms to municipal utilities that provide essential public services. Several incidents have been reported against infrastructure that, if disrupted, could affect community safety and economic stability.

Security analysts say SafePay’s success stems from a hybrid approach that pairs automated credential‑stuffing tools with customized social‑engineering messages, enabling the group to infiltrate both small enterprises with limited security budgets and larger organizations with more complex environments.

Officials urged companies to adopt multi‑factor authentication, maintain up‑to‑date patch cycles, and conduct regular employee awareness training. They noted that once the ransomware encrypts files, attackers typically demand payment, but the broader financial fallout includes operational downtime, data recovery expenses, and possible regulatory fines.

Although the FBI has not released specific ransom figures, it warned that the cumulative cost to affected entities can be substantial. The agencies continue to gather intelligence, encourage victims to report incidents, and aim to disrupt SafePay’s infrastructure through international cooperation and shared threat‑intel channels.