SafePay is one of the most active ransomware operations of 2026, and a joint advisory from the FBI, CISA and the Secret Service puts a number on it: at least 600 victims across critical infrastructure in North America, South America, Europe and Australia since August 2024.
Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency and the North West Regional Organised Crime Unit co-authored it. The advisory maps SafePay behaviour to MITRE ATT&CK and ships indicators of compromise through the StopRansomware programme.
How they get in
The initial access is not exotic. SafePay buys or guesses credentials, brute-forces exposed logins, exploits unpatched edge devices and VPN appliances, and phishes. Investigators saw the group routing activity through Mullvad VPN addresses and using phished account profiles to reach victim networks.
Once inside, they create accounts or seize existing ones for persistence, then move with living-off-the-land binaries. PsExec and Windows Remote Management carry the payload, while ShareFinder.ps1 and SharpShares.exe enumerate file shares so operators know what to take before they encrypt.
Preparation includes disabling security software, in some cases changing user passwords so legitimate logins stop working, and packing code to obscure it. Then comes encryption and a demand in cryptocurrency.
What actually reduces the risk
The mitigations are the standard set, and they keep appearing in post-incident reports because they work. Enforce phishing-resistant multifactor authentication on VPN and remote access, pull edge devices off direct internet exposure where possible, and patch known exploited vulnerabilities on a timetable rather than a wish list. Segment networks so one credential cannot reach the file shares holding the crown jewels. Alert on new administrative account creation, which is cheaper than discovering it during negotiations.
The honest read of 600 victims: two years of the same entry methods. Organisations that closed them are not in that count.
