FBI and CISA Warn SafePay Ransomware Has Hit 600 Global Targets

Federal agencies warn that SafePay ransomware has affected at least 600 organizations worldwide since August 2024. The Cybersecurity and Infrastructure Security Agency (CISA) joined the FBI, U.S. Secret Service, and law enforcement partners in Germany and the United Kingdom to issue the warning on October 20. SafePay operators use double extortion, stealing sensitive information before encrypting files and threatening to publish the stolen data if their ransom demands are not met. Federal investigators found that SafePay uses legitimate administrative tools, such as PowerShell, Remote Desktop Protocol, and Windows Remote Management, to move through compromised networks and prepare systems for ransomware deployment. CISA urges organizations to keep software updated, particularly VPN systems and firewalls, and to implement multifactor authentication to reduce the risk of compromise.