FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
At least 600 organizations across the U.S. and Europe have been breached by the SafePay ransomware gang since August 2024, according to a new advisory from international law enforcement agencies.
The FBI and cybersecurity agencies in Germany as well as the U.K. said SafePay is now “among the most active ransomware groups in 2026” and is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
The advisory was created based on numerous FBI and German law enforcement investigations involving SafePay, with the most recent incident occurring in August.
The advisory lists multiple vulnerabilities the group has used in attacks, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766 and others.
“Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones,” the agencies said. “They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection.”
The group also uses automated scripts to target vulnerabilities across internet-exposed systems.
In some cases, the hackers change the passwords of system users to make it harder for them to login and stop their activity.
They use legitimate tools to compress files and exfiltrate them before deploying the ransomware on victim devices. Legitimate remote desktop tools like AnyDesk or TeamViewer are used to transfer ransomware onto victim systems.
The advisory said SafePay typically holds encrypted data for ransom and demands “a subset of company revenue in cryptocurrency” in exchange for the decryption key.
“To put pressure on the victim, a representative makes phone calls on behalf of the ransomware group.”
The group’s leak site currently lists dozens of German companies as well as government organizations across Latin America and the U.S. Experts previously said parts of SafePay’s code resemble LockBit, a largely defunct ransomware operation that was previously responsible for hundreds of attacks.
SafePay has recently taken credit for attacks on one of the U.S.’s biggest providers of IT products and services, British tech company Microlise and government technology contractor Conduent.
The SafePay attack on Conduent caused significant damage across the U.S. because of the company’s role in Medicaid, child support, food assistance, roadway tolls and more. Conduent announced a $80 million settlement last Friday in response to a class action lawsuit filed in the wake of the ransomware attack.
