CISA said on 20 October 2026 that it issued a joint advisory on SafePay ransomware. The FBI, the US Secret Service and police agencies in Germany and the UK co-wrote it. The agencies say the group has been active since August 2024 and ranks among the most active in 2026. They count at least 600 victims across several critical infrastructure sectors. Attackers use phished account profiles, routed through Mullvad VPN addresses, to exploit known flaws in edge devices. They also run automated scripts against internet-exposed systems. Victims typically face a demand for a share of company revenue, paid in cryptocurrency, backed by phone calls.
The advisory draws on investigations as recent as August 2026. The sources do not say who runs SafePay or how many victims paid. Locked files cannot be opened without the attackers' key. The agencies advise against paying, since payment does not guarantee recovery.
The attack leans on trusted access and built-in admin tools, so a list of banned programs may miss it. The group also stops Windows shadow copies and resets backup storage to factory settings. Executives can ask: are backups out of reach of admin accounts? Are VPN and edge devices listed and patched? Which remote-access tools are approved?