CISA, FBI and Partners Release Joint Cybersecurity Advisory on SafePay Ransomware

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the U.S. Secret Service (USSS), and international partners released a joint Cybersecurity Advisory, #StopRansomware: SafePay Ransomware detailing SafePay ransomware activity, including known tactics, techniques and procedures (TTPs), indicators of compromise (IOCs), incident response actions and mitigations to help organizations reduce the likelihood and impact of an incident.

SafePay is one of the most active ransomware groups and have affected businesses and critical infrastructure in North America, South America, Europe, and Australia—including at least 600 organizations from multiple critical infrastructure sectors since August 2024. SafePay threat actors gain initial access through a variety of means, including credential exposure, brute force password attacks, and exploiting virtual private network (VPN) access—particularly the IP addresses of VPN provider “Mullvad”. They also use phished account profiles to infiltrate networks and exploit common vulnerabilities and exposures (CVEs) for edge devices and other internet-exposed systems through automated scripts. SafePay actors may disrupt recovery operations by deleting shadow copies and resetting network-attached storage devices containing backups. Their double-extortion model includes data theft, encryption, threats to publish stolen data and, in some cases, direct phone contact with victims.

Implement mitigations aligned to Cybersecurity Performance Goals 2.0, including these key actions:

• Regularly patch and update systems, especially VPNs, firewalls and other edge devices prioritizing and quickly remediating known exploited vulnerabilities (KEV) as they are identified.
• Implement identity, credential and access management (ICAM) policies and multifactor authentication (MFA) to strengthen account security.
• Restrict administrative tools and privileges to necessary users only.

Read the full advisory and learn how to detect SafePay activity and protect your organization from compromise. For more information on securing internet-facing and other edge devices, visit CISA’s Edge Device Security page.

Please share your thoughts with us through this anonymous survey. We appreciate your feedback.

This product is provided subject to this Notification and this Privacy & Use policy.