FBI warns SafePay ransomware gang breached 600 targets since 2024
International agencies say SafePay is among the most active groups in 2026, targeting critical infrastructure with phishing and exploits.
Key points
- At least 600 organizations have been breached by SafePay since August 2024.
- The group uses password guessing, phishing, and known vulnerabilities for access.
- Recent victims include US IT provider Conduent and UK firm Microlise.
The FBI and cybersecurity agencies in Germany and the United Kingdom issued a joint advisory warning that the SafePay ransomware gang has breached at least 600 organizations since August 2024. The agencies describe SafePay as one of the most active ransomware groups operating in 2026, with a broad campaign targeting businesses and critical infrastructure across the United States and Europe.
Law enforcement officials stated that the group gains initial access by guessing passwords, exploiting software vulnerabilities, and conducting phishing attacks. Once inside a network, SafePay actors create new accounts or compromise existing ones to establish control. They then leverage legitimate system tools to move laterally, identify high-value files, and disable security protections to avoid detection by defenders.
Tactics and Technical Indicators
The advisory lists several specific vulnerabilities that SafePay has exploited in its attacks, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. The group employs automated scripts to scan for these weaknesses on internet-exposed systems. In some incidents, attackers change system user passwords to lock out legitimate administrators and halt their activity, further consolidating their hold on the compromised environment.
After securing access, the hackers use legitimate tools to compress and exfiltrate sensitive data before deploying ransomware on victim devices. Remote desktop applications such as AnyDesk and TeamViewer are frequently used to transfer the malware onto systems. The group typically demands a subset of the victim’s company revenue in cryptocurrency in exchange for decryption keys. To increase pressure, representatives make phone calls to victim organizations on behalf of the ransomware gang.
Victims and Industry Impact
SafePay’s leak site currently lists dozens of German companies and government organizations across Latin America and the United States. The group recently claimed responsibility for attacks on Conduent, a US government technology contractor, and Microlise, a British tech company. The breach of Conduent caused significant disruption across the US due to the firm’s role in processing Medicaid, child support, food assistance, and roadway tolls.
Experts have noted that parts of SafePay’s code resemble that of LockBit, a largely defunct ransomware operation previously responsible for hundreds of attacks. The joint advisory was based on numerous FBI and German law enforcement investigations, with the most recent incident referenced occurring in August. No specific patch or fix for the SafePay infrastructure itself has been confirmed in the advisory.
What should you do?
Security teams should review their exposure to the specific CVEs listed in the advisory and ensure systems are patched against known vulnerabilities. Organizations should monitor for unauthorized account creations and changes to user passwords, which are common indicators of SafePay activity. Administrators should also audit the use of remote desktop tools like AnyDesk and TeamViewer to ensure they are not being abused for lateral movement or malware delivery.
What to do and how to stay safe: SafePay
- Audit internet-exposed systems for the specific CVEs mentioned in the advisory and apply patches immediately.
- Monitor authentication logs for unusual password changes or the creation of new administrative accounts.
- Restrict the use of remote desktop tools and ensure they are not installed on internet-facing servers.
- Verify that data exfiltration alerts are active and review outbound traffic for large, compressed file transfers.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many organizations has SafePay breached?
At least 600 organizations across the US and Europe have been breached since August 2024.
What vulnerabilities does SafePay exploit?
The group has used CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.
What are some recent high-profile victims?
SafePay claimed responsibility for attacks on Conduent and Microlise, among others.
