The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the US Secret Service (USSS), and international partners released a Joint Cybersecurity Advisory detailing SafePay ransomware activity, including known TTPs, IOCs, incident response actions, and mitigations to help organizations reduce the likelihood and impact of an incident.
Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.
The aforementioned agencies encourage organizations to implement the recommendations in the mitigations section of this advisory to reduce the likelihood and impact of SafePay ransomware incidents