What Happened
On October 20, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI, US Secret Service and international partners released a joint advisory concerning the SafePay ransomware group. The agencies say SafePay activity has reached businesses and critical-infrastructure organisations across North America, South America, Europe and Australia. Their account references at least 600 affected organisations since August 2024. This figure is a government assessment of the campaign, not a count independently verified by CyberGeek News.
How The Attacks Work
The advisory describes several ways actors obtain an initial foothold: using stolen or guessed account credentials, phishing, exploiting known weaknesses in externally accessible equipment and abusing remote-access or VPN services. After entering a network, the attackers may create accounts, misuse existing administrative tools and search for valuable information. Their activity combines data theft with encryption, creating pressure from both operational disruption and threats to disclose stolen files.
Why It Matters
The threat is relevant well beyond any one country. Organisations dependent on remote access, shared credentials or poorly protected backups are particularly exposed to the attack patterns described by the agencies. SafePay activity also illustrates why a backup can exist but still be unusable during an incident: the advisory warns that attackers sometimes interfere with shadow copies and network storage to hinder restoration.
What Defenders Should Do
Prioritise patching internet-facing edge equipment and vulnerabilities listed as known exploited. Require strong multifactor authentication for remote access and administrators; restrict privileged tools and monitor newly created accounts. Isolate backup management from ordinary user access and regularly test recovery. Incident responders should review the full joint advisory for its indicators, detection ideas and evidence-preservation guidance rather than relying on a headline alone.
What Remains Unconfirmed
The joint announcement does not establish that every organisation using a VPN has been compromised, or attribute an unspecified incident to SafePay. CyberGeek News is reporting the agencies' documented findings and recommended mitigations.