10/20/2026
Our new joint Cybersecurity Advisory with FBI – Federal Bureau of Investigation, United States Secret Service, and international partners shares technical details, detection and response guidance, and mitigations for SafePay—one of this year’s most active ransomware groups. Since 2024, SafePay has affected businesses and (CI) worldwide, including 600+ organizations from multiple CI sectors.
SafePay actors gain initial network access through various means, including stealing or guessing passwords, exploiting virtual private network (VPN) services, and phishing tactics. Once inside the network, they establish control by taking over or creating accounts, use legitimate tools to move through the network, and disable security measures to avoid detection. They encrypt and exfiltrate data, then leave a ransom note on the victim’s system threatening to post the exfiltrated data on their dedicated leak site if the ransom isn’t paid. They may also pressure victims by phone calls.
Take action to protect yourself:
🔷 Regularly patch systems, especially VPNs, firewalls and other edge devices.
🔷 Restrict administrative tools and privileges to only those who need them.
🔷 Strengthen identity, credential, and access management policies and implement multi-factor authentication (MFA).
Review the full advisory for indicators of compromise (IOCs), tactics, techniques and procedures (TTPs) and more using the link in the comment section below.