A joint advisory from US and European law enforcement and cyber agencies says the SafePay ransomware group has breached at least 600 organizations since August 2024 and is “among the most active ransomware groups in 2026.” The advisory was published on Tuesday and covers victims in North America, South America, Europe and Australia.
Six Agencies Document SafePay’s Reach Across Critical Infrastructure
The advisory comes from CISA, the FBI, the US Secret Service, Germany’s LKA Rheinland-Pfalz, and the UK’s National Crime Agency together with its North West Regional Organised Crime Unit. It is based on FBI and German investigations, and the most recent incident it describes occurred in August. Victims span critical infrastructure and other business sectors on multiple continents.
SafePay’s leak site lists dozens of German companies and government organizations in Latin America and the US. Researchers previously said parts of the group’s code resemble LockBit, though the advisory’s findings rest on the agencies’ own investigative work.
How SafePay Gains Initial Access
The advisory describes several ways SafePay affiliates get into victim networks, from stolen credentials and phishing to exploiting edge devices.
Credentials, Phishing and Mullvad VPN Addresses
The advisory lists several entry routes: exposed credentials, brute-forced passwords, phishing, and exploitation of VPN access, in particular IP addresses belonging to the VPN provider Mullvad. The group also uses automated scripts to exploit vulnerabilities in edge devices.
Edge-Device CVEs Named in the Advisory
Among the vulnerabilities the advisory lists are CVE-2020-3259, CVE-2023-20269, CVE-2023-27532 and CVE-2024-40711, along with CVE-2024-40766 and others. The agencies advise patching flaws listed in CISA’s Known Exploited Vulnerabilities catalog, particularly those affecting edge devices.
What SafePay Does After Getting In
Once inside a network, the operators create new accounts or take over existing ones, then use legitimate tools to move laterally. They disable security software, reset passwords, compress data and exfiltrate it. They also delete shadow copies and reset NAS devices to hinder recovery. The advisory says the group uses AnyDesk or TeamViewer to move the ransomware itself.
Extortion Tactics and Ransom Payments
SafePay demands payment in cryptocurrency, with the ransom set as a subset of a victim’s revenue. A representative phones victims to pressure them into paying. The agencies state that paying does not guarantee recovery of data.
The advisory’s own wording on scale is direct. It describes SafePay as among the most active ransomware groups in 2026, and it counts at least 600 victims since the group’s activity began in August 2024. That is a pace of hundreds of organizations in a little over two years, spread across four continents.
The post-intrusion steps listed in the advisory follow a consistent pattern. Operators create or take over accounts to keep access, disable security tooling before moving data, and then destroy recovery options by deleting shadow copies and resetting NAS devices. Because the group also uses AnyDesk or TeamViewer to move the ransomware, remote-access software that is legitimate in itself becomes part of the attack path.
Agency Recommendations and Reporting Requests
The agencies advise organizations to deploy multi-factor authentication, adopt identity, credential and access management policies, limit administrative tools, and patch KEV-listed edge vulnerabilities. They ask victims to report incidents to law enforcement. The advisory includes indicators of compromise and mitigation guidance for defenders.
The advisory also draws a line between SafePay’s tooling and its reputation. Experts previously said parts of the group’s code resemble LockBit, but the document’s operational findings come from FBI and German investigations rather than from code comparison. The leak site’s listing of dozens of German companies, alongside government organizations in Latin America and the US, shows the geographic spread the agencies describe, and the inclusion of Germany’s LKA Rheinland-Pfalz as a co-author reflects that German victims form a visible part of the group’s activity.
The inclusion of a German state police agency and a UK regional policing unit alongside the US federal agencies is notable for a single-group advisory. It reflects a case built from investigations on both sides of the Atlantic rather than from US telemetry alone. For organizations in the targeted sectors, the specific mention of Mullvad IP addresses gives network teams a concrete traffic pattern to look for in VPN logs, while the list of five named CVEs, several dating to 2020 and 2023, shows that SafePay’s initial access still depends on unpatched equipment that is years old.
