# SafePay

Published articles for SafePay.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## CISA: SafePay ransomware hit over 600 critical infrastructure orgs

DevFeed: [CISA: SafePay ransomware hit over 600 critical infrastructure orgs](<https://devfeed.tech/articles/cisa-safepay-ransomware-hit-over-600-critical-infrastructure-orgs-92562.md>)

Original publisher: [Read original article](<https://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/>)

Author: Sergiu Gatlan

Published: 2026-10-21T08:36:24Z

Content type: news

Language: en

Sources: [BleepingComputer](<https://devfeed.tech/sources/bleepingcomputer.md>)

Topics: [cybersecurity and infrastructure security agency](<https://devfeed.tech/topics/cybersecurity-and-infrastructure-security-agency.md>), [Disaster Recovery](<https://devfeed.tech/topics/disaster-recovery.md>), [Virtual Private Network](<https://devfeed.tech/topics/vpn.md>), [Network Attached Storage (NAS)](<https://devfeed.tech/topics/network-attached-storage-nas.md>)

Tags: [cisa](<https://devfeed.tech/tags/cisa.md>), [computer-help](<https://devfeed.tech/tags/computer-help.md>), [computer-security](<https://devfeed.tech/tags/computer-security.md>), [computers](<https://devfeed.tech/tags/computers.md>), [critical-infrastructure](<https://devfeed.tech/tags/critical-infrastructure.md>), [cybersecurity-and-infrastructure-security-agency](<https://devfeed.tech/tags/cybersecurity-and-infrastructure-security-agency.md>), [fbi](<https://devfeed.tech/tags/fbi.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [infosec-computer-security](<https://devfeed.tech/tags/infosec-computer-security.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mac](<https://devfeed.tech/tags/mac.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-removal](<https://devfeed.tech/tags/malware-removal.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [safepay](<https://devfeed.tech/tags/safepay.md>), [secret-service](<https://devfeed.tech/tags/secret-service.md>), [security](<https://devfeed.tech/tags/security.md>), [spyware](<https://devfeed.tech/tags/spyware.md>), [support](<https://devfeed.tech/tags/support.md>), [tech-support](<https://devfeed.tech/tags/tech-support.md>), [technical-support](<https://devfeed.tech/tags/technical-support.md>), [virus](<https://devfeed.tech/tags/virus.md>), [virus-removal](<https://devfeed.tech/tags/virus-removal.md>), [warning](<https://devfeed.tech/tags/warning.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

CISA and partner agencies report that SafePay has affected at least 600 critical infrastructure organizations across multiple regions since August 2024. The group gains access through exposed credentials, brute-force attacks, VPN access, phishing, and vulnerabilities in edge or internet-exposed systems; it may then steal data, encrypt systems, and delete shadow copies or reset network storage containing backups. Paying a ransom does not guarantee file recovery. The agencies recommend restricting administrative tools and privileges, using multifactor authentication and identity, credential, and access management policies, and patching actively exploited flaws in VPNs, firewalls, and other edge devices. The advisory also provides indicators of compromise and tactics from investigations covering November 2024 through August 2026.

### Source excerpt

The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...]