The SafePay ransomware syndicate has targeted more than 600 critical infrastructure organizations worldwide since August 2024, according to a joint international cybersecurity advisory issued by the US Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and multinational law enforcement partners. Encompassing operations across North America, South America, Europe, and Australia, the group has compromised key utilities and commercial institutions by breaching edge infrastructure and actively sabotaging data recovery channels. The advisory, produced alongside the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK’s National Crime Agency, and the North West Regional Organised Crime Unit, warned affected entities that submitting to ransom demands provides no assurance that encrypted files will be recovered.
Intrusions Stem from Exposed Credentials and Edge Vulnerabilities
Federal investigators found that SafePay gains initial network access primarily by utilizing compromised login credentials, brute-force password tactics, and known vulnerabilities within virtual private network infrastructure. Attackers routinely weaponize credentials obtained via phishing schemes and abuse IP addresses associated with commercial VPN services to blend in with legitimate network traffic. The syndicate also deploys automated scanning scripts to identify and penetrate unpatched, internet-facing devices, including firewalls, gateway appliances, and remote access software.
Once a perimeter breach is established, the group moves laterally across internal systems by exploiting lax administrative controls and unsegmented environments. Inadequate privilege management allows attackers to expand their reach from secondary endpoints to core domain controllers, magnifying the operational impact of an initial intrusion across an entire enterprise.
Backups Systematically Destroyed in Double-Extortion Campaigns
A central component of SafePay’s methodology involves deliberately neutralizing an organization’s ability to recover independently. Investigators determined that the group actively purges Windows shadow copies and resets network-attached storage appliances containing offline or secondary backups. By stripping victims of reliable recovery mechanisms before launching cryptographic locks, the attackers seek to force compliance with substantial extortion demands and prolong operational disruptions.
The syndicate couples this technical disruption with double-extortion tactics, exfiltrating sensitive internal records prior to file encryption. Threat actors threaten to publish proprietary corporate data and confidential employee information on dark web leak platforms if ransom payments are withheld, exposing affected organizations to ongoing regulatory liability, privacy litigation, and severe reputational harm even if operational systems are successfully recovered.
Privately Run Group Fills Vacuum in Ransomware Ecosystem
Unlike many contemporary cybercrime cartels that rely on affiliate networks, SafePay operates as a closed, independent group. Operating since August 2024, the gang has posted hundreds of non-compliant victims on its dark web disclosure portal, though authorities noted that the true number of impacted institutions is likely significantly higher because victims who settle privately or maintain quiet negotiations do not appear on public leak directories. The group has grown into one of the most prolific operators since early 2025, stepping into market share left vacant following international disruptions against BlackCat and LockBit.
Security agencies have advised critical infrastructure providers to enforce strict identity controls, including multifactor authentication and robust credential governance policies. Network administrators are urged to restrict lateral administrative movement, maintain air-gapped backups isolated from production networks, and prioritize updates for edge devices on CISA’s actively exploited vulnerabilities catalog. Official bodies reiterated that victims must notify law enforcement immediately and avoid treating extortion payments as a reliable recovery strategy.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
