The Cybersecurity and Infrastructure Security Agency, the FBI and the US Secret Service, working with partners in Germany and the United Kingdom, have issued a joint advisory warning that the SafePay ransomware group has claimed roughly 600 victims across multiple critical infrastructure sectors in the Americas, Europe and Australia.

The advisory, AA26-293A, was released on October 21 under the #StopRansomware program. Germany’s Landeskriminalamt Rheinland-Pfalz and the UK’s National Crime Agency helped develop it.

How SafePay gets in

According to the agencies, SafePay actors typically gain access with compromised credentials, by exploiting known vulnerabilities in internet-facing devices, or through VPN connections. Once inside, they move through networks using legitimate IT tools rather than custom malware, delete or disable backups to make recovery harder, and steal data before encrypting systems. Victims are then pressured with threats to publish the stolen data, sometimes by phone.

“Public-facing devices with known vulnerabilities continue to be frequently targeted,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.

What organizations should do now

  • Patch known exploited vulnerabilities in internet-facing systems first, including VPNs and remote-access equipment.
  • Require multifactor authentication, especially for remote access and administrator accounts.
  • Keep offline backups and regularly test that you can restore from them.
  • Segment networks so one compromised system cannot reach everything.
  • Review the advisory’s indicators of compromise and look for signs of intrusion.

The full advisory, including technical indicators, is available on CISA’s website.

Sources: CISA, HSToday, HIPAA Journal.

Image: illustration created for AABEAT TV. It does not depict the people, places or products named in this story.