SafePay Ransomware Hits 600+ Entities; Agencies Issue Coordinated Warning

Key points

• SafePay has compromised over 600 organizations since the start of 2024.
• The FBI, CISA, U.S. Secret Service, Germany's LKA, and British police issued a coordinated warning in recent days.
• The group combines encryption with threats to publish stolen data.
• Initial entry often comes through credentials taken from victims and remote-access VPN accounts.
• No CVE is listed, so identity and remote-access controls are the main defensive focus.

SafePay has compromised more than 600 entities since the beginning of 2024, according to a coordinated warning issued in recent days by the FBI, CISA, the U.S. Secret Service, Germany's LKA, and British police agencies. The group encrypts victim systems and also threatens to release exfiltrated data, a two-pronged coercion model that raises the cost of an incident even when backups are available. Investigators say the gang frequently gains its first foothold through login data harvested from victims and through remote-access VPN accounts.

The advisory is notable because it lists no CVE. There is no single missing patch that closes this path. Defenders should treat identity and remote access as the primary control surface: VPN concentrators, shared administrative accounts, and remote staff access all deserve scrutiny. For K-12 environments, where remote access often supports district staff and vendors, the pattern is directly relevant even if no school-specific targeting has been confirmed.

The scale of more than 600 affected organizations points to an industrialized campaign rather than an opportunistic smash-and-grab. The involvement of agencies from several countries suggests cross-border infrastructure and a threat that does not stop at national borders. SafePay's combination of encryption and data-leak pressure means recovery planning must cover both system restoration and breach notification, legal review, and public communication.

What to watch: unusual VPN authentications, repeated MFA prompts, new device enrollments, and signs of data staging before encryption. Review remote-access logs for logins from unfamiliar locations or at odd hours, and check whether dormant or shared accounts are still active. Because no CVE is available as a shortcut, prioritize credential hygiene, phishing-resistant MFA, least privilege, isolated backups, and tabletop exercises. Report suspicious activity to the FBI, CISA, and state or local law enforcement, and review the joint guidance for detection opportunities.

What to do now

1. Require phishing-resistant MFA on every VPN and remote-access gateway, and disable legacy authentication methods.
2. Audit all remote-access accounts, rotate credentials, and revoke dormant, shared, or unexplained accounts immediately.
3. Restrict VPN exposure with geo/IP allowlists where feasible, patch appliances, and alert on anomalous login patterns.
4. Hunt for SafePay activity: unusual authentication, MFA fatigue, new device enrollment, data staging, and backup deletion attempts.
5. Isolate backups and confirm offline or immutable copies are restorable; test recovery without relying on the production network.
6. Brief staff on credential phishing and unexpected MFA prompts, and enforce least privilege for administrative accounts.
7. Report suspected intrusions to the FBI, CISA, and local law enforcement, and review the multi-agency advisory for indicators.

Original source

Security Affairs