Introduction
A new international law-enforcement advisory has identified SafePay as “among the most active ransomware groups in 2026,” warning that the operation has breached at least 600 organisations across the United States and Europe since August 2024. The advisory was issued jointly by the FBI together with cybersecurity agencies in Germany and the United Kingdom, drawing on numerous investigations into SafePay activity — with the most recent incident traced to August of this year. SafePay’s targets span private businesses as well as critical infrastructure, and the group’s tactics combine password guessing, exploitation of known vulnerabilities, and phishing to gain initial access.
For organisations that follow cybersecurity reporting, SafePay’s emergence is a reminder that ransomware remains an active and evolving threat even as some high-profile operations have faded from view. Readers tracking the sector can find additional coverage of this threat landscape in this cybersecurity category. The primary FBI advisory report documents how SafePay operates once inside a victim network, what vulnerabilities it leverages, and which victims it has claimed on its leak site.
Attack Methods and Exploited Vulnerabilities
SafePay gains access through three primary vectors. First, attackers guess passwords against exposed systems, including weak or default credentials on internet-facing accounts. Second, they exploit known vulnerabilities in public-facing applications and infrastructure. Third, they use phishing messages to trick employees into handing over credentials or executing malicious attachments.
The advisory lists multiple vulnerabilities the group has used in its campaigns, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766, among others. Some of these flaws date back several years, which means SafePay is effectively hunting for organisations that have not patched older issues — a persistent reality of enterprise security hygiene. The group also runs automated scripts against internet-exposed systems, scanning for any target that presents an unpatched entry point.
Post-Exploitation Playbook
Once inside a network, SafePay actors do not rush to encrypt. Instead, they establish control by creating new accounts or taking over existing ones, then use legitimate system tools to move laterally through the environment. They identify valuable files, disable security protections to avoid detection, and in some cases change the passwords of system users to make it harder for staff to log in and interrupt the attack.
The group compresses stolen data and exfiltrates it before deploying ransomware on victim devices. This double-extortion posture means victims face both encrypted systems and the threat that their data will be published or sold if they refuse to pay. SafePay operators also rely on legitimate remote desktop tools — specifically AnyDesk and TeamViewer — to transfer ransomware payloads onto compromised systems, abusing software that many organisations already trust for IT support.
Notable Targets: Microlise and Conduent
SafePay has claimed credit for attacks on significant organisations, including one of the United States’ largest providers of IT products and services, and Conduent, a government technology contractor. Conduent’s role spans Medicaid administration, child support programmes, food assistance distribution, and roadway toll collection, so an attack on that company has public-sector consequences well beyond a single corporate victim. The breach caused significant damage across multiple states in the U.S.
Conduent announced an $80 million settlement last week in response to a class-action lawsuit filed after the ransomware attack. The figure underscores how quickly a ransomware incident can translate into major financial liability — covering not just the cost of restoration but also the broader exposure from compromised personal data.
Extortion Tactics: Ransom Demands and Phone Calls
The advisory states that SafePay typically holds encrypted data for ransom and demands “a subset of company revenue in cryptocurrency” in exchange for the decryption key. To increase pressure on victims, the group’s representatives make phone calls on behalf of the ransomware operation, a tactic that personalises the threat and accelerates decision-making for stressed victim organisations.
SafePay’s leak site currently lists dozens of German companies as well as government organisations across Latin America and the United States. The geographic spread — encompassing European businesses, Latin American public bodies, and U.S. government contractors — shows that the group operates without regard for sector or border, targeting whatever organisations present accessible vulnerabilities.
Server rooms and data centres like the one pictured above are precisely the kind of critical infrastructure SafePay targets when it compromises government contractors and technology providers that manage public benefits, toll systems, and healthcare records on behalf of public-sector clients.
Connection to LockBit
Experts previously noted that parts of SafePay’s code resemble LockBit, a largely defunct ransomware operation that was previously responsible for hundreds of attacks around the world. LockBit’s disruption did not end ransomware as a business model; instead, newer groups such as SafePay have picked up techniques, infrastructure, and in some cases code fragments from predecessor operations. For defenders, this means studying past ransomware playbooks remains relevant, because the same methods continue to work against insufficiently hardened targets.
Implications for Critical Infrastructure
SafePay’s stated targeting of critical infrastructure brings the threat into the realm of essential public services. The Conduent breach — affecting Medicaid records, child support processing, food assistance, and toll road systems — illustrates how a ransomware incident at a single contractor can ripple through multiple government programmes and affect ordinary citizens’ access to benefits and services. Organisations that support public-sector contracts should treat ransomware readiness as a public-responsibility issue rather than purely an IT concern.
Mitigation and Recommendations
Defenders can reduce SafePay-style risk through several concrete measures:
- Patch the listed CVEs promptly, including older flaws such as CVE-2020-3259, since SafePay actively hunts unpatched internet-exposed systems.
- Enforce strong, unique passwords and multi-factor authentication on all remote access and administrative accounts.
- Limit the use of remote desktop tools such as AnyDesk and TeamViewer to approved, monitored channels, and alert on unexpected usage.
- Monitor for the creation of new accounts, unusual lateral movement using legitimate system tools, and attempts to disable security software.
- Maintain offline, tested backups so that encryption alone does not force a ransom payment decision.
- Assume that data may be exfiltrated before encryption, and plan incident response accordingly.
Effective defence treats ransomware readiness as an organisational capability rather than an IT checkbox: account hygiene, vulnerability management, and offline backups together determine whether an actor like SafePay can turn an initial intrusion into a business-disrupting event.
Detection and Monitoring
Beyond patching known vulnerabilities, organisations should deploy behavioural monitoring to spot the early signs of SafePay-style activity:
- Lateral movement alerts — Monitor for unusual process creation such as remote execution utilities, and for unexpected service changes on managed systems.
- Credential access anomalies — Alert when privileged accounts are used outside their normal schedule or from unfamiliar IP ranges.
- Data exfiltration patterns — Watch for large outbound transfers to previously unseen destinations, especially during off-hours.
- Remote desktop tool misuse — Flag any use of AnyDesk, TeamViewer, or comparable tools by non-IT staff without documented approval.
These signals frequently appear before encryption begins, giving security teams a narrow but genuine window to isolate affected systems, revoke compromised credentials, and initiate containment before operational disruption sets in.
References
- “FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024,” Recorded Future News / The Record, October 2026.