At least 600 organizations across multiple critical infrastructure sectors have been affected by SafePay ransomware since August 2024. The group enters through exposed credentials, brute-force attempts, VPN access, and known edge-device weaknesses. It steals data, encrypts systems, and pressures victims through leak threats and direct calls.
Why It Matters
SafePay commonly uses legitimate administration and file-transfer tools, making its movement harder to distinguish from normal work. It also deletes shadow copies and resets some network-attached backups. For leaders: recovery plans fail if attackers can reach backup systems. For defenders: prioritize edge patches, multifactor authentication, account controls, and offline immutable backups. The larger lesson is that ransomware still succeeds through preventable identity and access gaps.
What Defenders Should Do
Secure internet-facing access, enforce multifactor authentication, restrict administrative tools, and verify that backups cannot be altered from production.