US, German and UK agencies say SafePay ransomware has hit at least 600 organizations since August 2024
A joint advisory calls SafePay one of the most active ransomware groups of 2026 and lists the vulnerabilities and access methods it uses.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
CISA, the FBI and the U.S. Secret Service, along with Germany's Landeskriminalamt Rheinland-Pfalz and the UK's National Crime Agency and North West Regional Organised Crime Unit, have issued a joint advisory on the SafePay ransomware gang. The agencies say the group has breached at least 600 organizations in several critical infrastructure sectors since August 2024, in North America, South America, Europe and Australia, and call it among the most active ransomware groups in 2026. The advisory draws on FBI and German law enforcement investigations, the most recent involving an incident in August. According to the agencies, SafePay gets in through exposed credentials, brute-force password attacks, phishing and exploited vulnerabilities, including VPN access, and often uses IP addresses of the VPN provider Mullvad. Once inside, the attackers create or take over accounts, use legitimate system tools to move through networks, and disable security protections. In some cases they change user passwords to lock out the people trying to stop them. The agencies advise defenders to restrict administrative tools and privileges, to use multifactor authentication and identity and access management controls, and to report incidents. They warn that paying a ransom does not guarantee that encrypted files will be recovered.