ScamWatch USA
Log in
Back to Scam Alerts
CRITICAL THREAT · Cybersecurity Threat

CISA and FBI Issue Critical Alert Regarding SafePay Ransomware

The Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the U.S. Secret Service, and international partners have issued a joint advisory regarding the SafePay ransomware group, which has targeted over 600 critical infrastructure organizations globally since August 2024.

10/22/2026Critical Infrastructure NetworksVPN GatewaysEnterprise FirewallsWindows-based Server Environments

Warning signs

  • Unauthorized access to VPNs or firewalls
  • Unexpected use of file compression tools like FileZilla, 7-Zip, or WinRAR
  • Evidence of data exfiltration prior to system encryption
  • Presence of ransom notes on network systems
  • Indicators of compromise (IOCs) identified in CISA advisory AA26-293A

What you should do

  • Keep all internet-facing devices, particularly VPNs and firewalls, updated with the latest security patches
  • Review the official CISA advisory AA26-293A for specific technical indicators of compromise
  • Implement robust multi-factor authentication (MFA) across all network access points
  • Maintain offline, encrypted backups of critical data
  • Monitor network telemetry for suspicious activity or unauthorized use of administrative tools
SafePay is a private ransomware operation that has emerged as one of the most active threat groups in 2026. Operating without affiliates, the group utilizes stolen credentials and exploits vulnerabilities in internet-facing devices, such as VPNs and firewalls, to gain initial access. Once inside a network, the actors employ double extortion tactics, stealing sensitive data before encrypting systems to pressure victims into paying ransoms. The group has been observed using legitimate software tools like FileZilla, 7-Zip, and WinRAR to facilitate data collection and compression. Attacks have been documented across North America, South America, Europe, and Australia, impacting multiple critical infrastructure sectors.

Sources

https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293ahttps://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizationshttps://securityaffairs.com/201464/cyber-crime/fbi-and-cisa-warn-of-safepay-ransomware-attacks-on-600-organizations.htmlhttps://www.cybersecuritydive.com/news/fbi-cisa-warn-safepay-ransomware-threat-critical-infrastructure/833589