# SafePay Ransomware Has Hit 600+ Victims, FBI and CISA Warn

- URL: https://usa-24.com/safepay-ransomware-advisory-fbi-cisa/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-25T07:13:38.808Z
- Updated: 2026-10-25T07:13:38.814Z
- Topics: Ransomware, SafePay, CISA, FBI, VPN Security, Cyber Threats

> The FBI, CISA and partners say SafePay has hit more than 600 organizations, mostly through stolen logins and VPN or edge-device flaws.

## Key takeaways

- A joint FBI, CISA and partner advisory issued October 20, 2026 says SafePay has affected more than 600 victims worldwide since August 2024.
- Attackers reportedly get in with compromised credentials and by targeting known vulnerabilities in internet-facing devices and VPNs.
- Encrypted files take a .SafePay extension and use ChaCha20 with RSA, and the advisory says they cannot be recovered without the key.
- The agencies urge organizations to patch known-exploited flaws first, enable multifactor authentication, restrict admin privileges and keep secure backups.
- Halcyon estimates roughly 15 to 30 organizations were targeted each month in 2026, a private researcher's figure rather than an agency count.

Five days after the FBI and CISA issued a joint warning, SafePay ransomware is drawing fresh attention for a simple reason: the group has hit more than 600 organizations, and most of those intrusions started with stolen logins or flaws in internet-facing devices. The warning reads less like a threat report than a to-do list for anyone who runs a VPN or a firewall.

The advisory was published October 20, 2026, as a #StopRansomware product. [HSToday](https://www.hstoday.us/subject-matter-areas/cybersecurity/fbi-and-cisa-warn-safepay-ransomware-group-is-targeting-critical-infrastructure-worldwide/) reports that the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the North West Regional Organised Crime Unit are among the named partners. Follow-up reports identify the advisory as AA26-293A, including [Safeguard.sh](https://safeguard.sh/resources/blog/safepay-ransomware-cisa-advisory). USA 24 did not have access to the full advisory text when this story was written, so the specifics below come from secondary reports that cite it. Check the primary document before relying on any single figure.

## What the SafePay ransomware advisory says

According to the advisory as summarized by HSToday, SafePay has affected more than 600 victims worldwide since August 2024, across North America, South America, Europe and Australia. The agencies describe SafePay as a financially motivated operation, and [Tech-Insider](https://tech-insider.org/fbi-cisa-safepay-ransomware-600-victims-2026/) reports that it has been highly active since August 2024.

The 600 figure is the headline, but it needs context. It is a cumulative total covering more than two years, not a count of victims in a single campaign and not a measure of how many are being hit right now. [The Cyber Express](https://thecyberexpress.com/safepay-ransomware-hit-600-victims/) reports that the investigations behind the advisory extend as recently as August 2026, which suggests the agencies have been tracking the group well into this year.

Each #StopRansomware advisory follows a standard format: a threat profile paired with mitigation steps. That structure matters here, because the mitigations are where most security teams can act this week. The threat profile tells you what to look for. The mitigation list tells you what to fix.

## How SafePay gets in and moves data

Attackers reportedly get in with compromised credentials. They have also targeted known vulnerabilities in internet-facing devices and VPNs, according to [Cybersecurity Dive](https://www.cybersecuritydive.com/news/fbi-cisa-warn-safepay-ransomware-threat-critical-infrastructure/833589/). Those two paths reinforce each other. A stolen password lets an intruder pass as a legitimate remote worker, while an unpatched edge device gives an intruder a way in without needing a password at all.

Edge devices have been a steady target. USA 24 has reported on a separate campaign in which hackers harvested 70,000 credentials from [FortiGate and GlobalProtect](https://usa-24.com/fortigate-credentials-stolen-k0t-campaign/) systems, which shows how valuable a single login to a remote access device can be.

Once inside, the group leans on legitimate software. Cybersecurity Dive reports that SafePay has used FileZilla, 7-Zip and WinRAR to collect and compress data, and WinSCP and RClone to move it out. None of these programs is malicious on its face, and many IT teams run them every day. That is exactly why they work for attackers and why they are hard to flag on their own. Defenders should look for them where they do not normally run, and for large outbound transfers to destinations the company does not recognize.

The encryption is the last step, and it is the hardest to undo. Encrypted files take a .SafePay extension and use ChaCha20 with RSA, according to The Cyber Express. The advisory says those files cannot be recovered without the key, which makes prevention and tested recovery far more valuable than any decision made after the files are locked.

## Which organizations are most exposed

Any US organization running VPNs, firewalls or other internet-facing systems is in scope. The advisory names critical infrastructure operators as priority targets, according to HSToday and Tech-Insider. For a utility or a hospital with a remote access portal, that is not an abstract warning. For a mid-sized company with a single VPN appliance, the exposure is the same. The attacker does not need to know the business. They need an open door.

Cybersecurity Dive reports that Halcyon estimates roughly 15 to 30 organizations were targeted each month in 2026, with volume reportedly peaking at the end of 2025. That is a private researcher's estimate, not an agency figure. Cynthia Kaiser, senior vice president of Halcyon Ransomware Research Center, put the threat plainly: "SafePay certainly poses such a threat."

Public institutions are not exempt. USA 24 has reported that [Oneonta City Schools](https://usa-24.com/oneonta-city-school-district-ransomware-attack/) closed until Tuesday after a ransomware attack, a reminder that a school district can lose its systems as quickly as a corporation.

## Steps to take this week

The advisory's recommendations, as summarized in these reports, reduce to a short list that most IT teams can start today:

- Patch known-exploited vulnerabilities first, starting with VPN concentrators and firewalls.
- Enforce multifactor authentication on every remote access and administrator account.
- Restrict administrative privileges and review where credentials are exposed.
- Keep offline or immutable backups, and test restores rather than assuming they work.
- Hunt for WinSCP and RClone activity and for unusual outbound data transfers.

Start with the edge. Inventory every internet-facing device, check its firmware and software versions against vendor advisories, and treat any device on the known-exploited list as a same-week fix. Then look at accounts. A stolen password on a VPN account with administrator rights is a far bigger problem than one on a standard user account, which is why restricting admin privileges matters as much as MFA. Schedule restore tests and record how long they take, so you know your real recovery time before you need it.

## Where the numbers are still unsettled

The reports do not agree on everything. Tech-Insider says five other law enforcement partners joined the advisory, while Safeguard.sh says four. Treat the partner count as unresolved until the primary document is checked.

The victim figure also needs careful reading. It is cumulative since August 2024 and is not a current count of active victims. The monthly rate comes from a private researcher, not the agencies. The sources reviewed do not explain why the agencies chose to publish the advisory now.

None of the sources read for this story named specific US victims, and no US victim has been publicly tied to this advisory in the reporting reviewed. Anyone who wants to know whether SafePay has targeted their company should check their own logs for the tools and outbound transfers described above, rather than waiting for a victim list.

## What to watch next

Three things bear watching. First, whether the agencies publish updated indicators or a fuller breakdown of affected sectors. Second, whether US organizations begin disclosing incidents tied to SafePay. Third, whether the group changes the tools and entry points the advisory describes, which would make the current mitigation list less effective.

The most useful response is the least glamorous one: close the doors the advisory names, test the backups, and assume that at least one credential in your environment is already exposed.

## Frequently asked questions

### What is SafePay ransomware?

SafePay is a financially motivated ransomware group that, according to a joint FBI and CISA advisory issued October 20, 2026, has been highly active since August 2024. The advisory says it has affected more than 600 victims worldwide across North America, South America, Europe and Australia. Attackers reportedly get in with compromised credentials or through known flaws in internet-facing devices and VPNs.

### How does SafePay encrypt files?

Encrypted files take a .SafePay extension and use ChaCha20 with RSA public-key cryptography. The advisory says those files cannot be recovered without the key. That makes offline or immutable backups, tested regularly, the most reliable defense once an attack has begun.

### How can I tell if SafePay is targeting my company?

The sources reviewed do not include a public list of targeted US companies. Start by checking whether you run VPNs, firewalls or other internet-facing systems with known-exploited flaws. Look for WinSCP or RClone activity and unusual outbound data transfers, and review the advisory itself on CISA's site.

### What should organizations do first to protect against SafePay?

Patch known-exploited vulnerabilities first, especially on VPN concentrators and firewalls. Enforce multifactor authentication on remote access and admin accounts, restrict administrative privileges and keep tested offline backups. These steps match the mitigations the agencies recommend.

## Sources

1. [HSToday — FBI and CISA Warn SafePay Ransomware Group Is Targeting Critical Infrastructure Worldwide](https://www.hstoday.us/subject-matter-areas/cybersecurity/fbi-and-cisa-warn-safepay-ransomware-group-is-targeting-critical-infrastructure-worldwide/)
2. [Cybersecurity Dive — FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure](https://www.cybersecuritydive.com/news/fbi-cisa-warn-safepay-ransomware-threat-critical-infrastructure/833589/)
3. [The Cyber Express — SafePay Ransomware Hit 600+ Victims, FBI And CISA Warn](https://thecyberexpress.com/safepay-ransomware-hit-600-victims/)
4. [Tech-Insider — FBI, CISA: SafePay Ransomware Hit 600 Firms [2026]](https://tech-insider.org/fbi-cisa-safepay-ransomware-600-victims-2026/)
5. [Safeguard.sh — SafePay Ransomware: What CISA Advisory AA26-293A Says and What to Do](https://safeguard.sh/resources/blog/safepay-ransomware-cisa-advisory)