More than 600 critical infrastructure organizations worldwide have been affected by SafePay ransomware since August 2024, according to a joint government warning. The group uses exposed credentials, password attacks, phishing and weaknesses in internet-facing edge devices. It can enter through VPN services, move with legitimate administration tools and steal data before encryption. SafePay has also disrupted recovery by deleting shadow copies and resetting network storage holding backups.
Why It Matters
Victims span multiple critical sectors across North America, South America, Europe and Australia. The group uses double extortion, so recovery and data exposure must be managed together. For leaders: tested recovery and incident reporting matter because paying does not guarantee restoration. For defenders: strengthen identity controls, restrict administration tools and prioritize updates for VPNs, firewalls and known exploited edge devices. The larger pattern is that weak identities and exposed infrastructure remain reliable ransomware entry points.
What Defenders Should Do
Enforce multifactor authentication, reduce administrative privilege, patch exposed edge systems and test protected backups against destructive access.