- A joint advisory from US, German and UK agencies says SafePay ransomware has compromised at least 600 critical infrastructure organizations since it emerged in August 2024.
- The group relies on ordinary administrator tools and file-transfer software, so its activity can resemble normal IT work.
- Test your patching, multi-factor authentication, backups, segmentation and network monitoring against the advisory's list. Add your own checks on admin tools and outbound transfers.
The intruder uses your administrator's toolkit
Some attacks are hard to separate from routine IT work. SafePay is built around that overlap. It depends on software that organizations already install and trust.
Government agencies in the US, Germany and the UK issued a joint advisory on the group. Infosecurity Magazine says the US cyber agency CISA is one of the authoring bodies. CISA published the advisory on October 20.
The agencies count at least 600 victims in critical infrastructure. The group emerged in August 2024. Victims are spread across North America, South America, Europe and Australia.
How a SafePay attack works
Infosecurity Magazine's account of the advisory lists several ways in. The attackers use exposed credentials and password guessing by brute force. They also get in through virtual private networks (VPNs). And they exploit flaws in edge devices. Edge devices sit at the boundary of a network, such as remote access gateways.
Once inside, the attackers look for administrator rights. They may use existing accounts or newly created ones. Then they move sideways to reach sensitive systems and data.
To move between machines, the advisory names PsExec, WinRM and remote monitoring and management (RMM) products. These are normal tools for running computers from afar. Remote desktop protocol (RDP) helps the attackers spread further. Security teams call this approach "living off the land". The attacker uses what is already there.
The attackers typically turn off security software. They have also hidden their code with software packing. To steal data, they use FileZilla, OneDrive, 7-Zip, RClone and WinRAR. The files go to accounts the attackers control.
Only after the theft do they lock files. The lock combines a ChaCha20 stream cipher with RSA public-key encryption.
Why pressure, not only encryption, is the lever
SafePay uses double extortion. It leaves a ransom note, usually on the desktop or root folder. The note points victims to a chat portal on a TOR link. They log in with a victim ID.
The group typically asks for a share of company revenue, paid in cryptocurrency. A representative also phones victims to add pressure. If a victim refuses, the stolen data goes onto the group's leak website.
This matters for planning. Backups help a company restore its systems. They cannot take back data that was already copied out. The leak threat remains even when recovery works.
What the group's record shows
Infosecurity Magazine points to two outside trackers. A BlacKite report from June 2026 placed SafePay third among ransomware groups for the first four months of the year. Its main focus was Germany.
NCC Group ranked SafePay first for May 2026 by claimed attacks, with 70 that month. Those are the group's own claims, as counted by NCC Group.
The outlet also describes a believed link to Conduent, a US business services firm. A ransomware attack in November 2024 exposed a substantial amount of personal and healthcare data there. Conduent agreed on October 16, 2026 to an $80m class action settlement over that breach.
The link to SafePay is a belief, not a finding. If it holds, the case shows how long one intrusion can cost. That is nearly two years from attack to settlement.
Questions to put to your team
Most of the questions below follow the advisory's own list of defenses. Two are our additions, drawn from the attack methods. We mark them.
First: how fast do we fix known exploited vulnerabilities, especially on VPNs and edge devices? Second: is multi-factor authentication required on every account?
Third, and this one is ours: who may run PsExec, WinRM and RMM tools? Would we notice an unexpected user?
Fourth: are our backups offline, encrypted and immutable, meaning they cannot be changed? Have we tested a full restore? Fifth: is the network segmented, so one stolen account cannot reach everything? Sixth: does a network monitoring tool flag abnormal activity?
Our second addition: alert on large file transfers to outside accounts, because that is how this group steals data. The advisory, as reported, does not list that step.
The group's tools are ordinary. That makes the central question a simple one. Can your team tell an administrator's routine work from an intruder's use of the same tools?
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Infosecurity Magazine.
