FBI and CISA warn of active SafePay ransomware threat

The FBI, CISA, and cybersecurity agencies in the United Kingdom and Germany have issued a joint advisory warning that the SafePay ransomware gang has become one of the world’s most active cybercrime operations. Since August 2024, the group has breached at least 600 organizations, with a specific focus on critical infrastructure providers across North and South America, Europe, and Australia.

SafePay actors gain access to networks by exploiting vulnerabilities in internet-facing edge devices, using phishing attacks, or guessing passwords. Once inside, the group employs ‘living-off-the-land’ techniques, utilizing legitimate system tools like Windows Remote Management, PsExec, AnyDesk, or TeamViewer to move through networks, disable security protections, and exfiltrate data. In some instances, they change system user passwords to prevent victims from regaining control.

The group typically demands a portion of a company’s revenue in cryptocurrency in exchange for decryption keys. To increase pressure on victims, representatives from the group have been known to make direct phone calls. The group’s leak site currently lists numerous German companies alongside government organizations in Latin America and the United States.