CISA, the FBI and international partners released a joint advisory on SafePay ransomware this week. It says the group has hit at least 600 organizations since August 2024. BleepingComputer, Infosecurity Magazine and The Record all reported it on October 20-21.
The victims span North America, South America, Europe and Australia, across multiple critical infrastructure sectors. The agencies call SafePay one of the most active ransomware operators. 600 is a floor, not a final count.
Initial access is mostly ordinary. According to the advisory, SafePay uses stolen credentials, password guessing and VPN access, with a focus on IP addresses tied to the VPN provider Mullvad. It also uses phished accounts and automated scripts that exploit known CVEs in edge devices. The advisory lists CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.
The group runs double extortion. Before encrypting, it deletes shadow copies and resets network-attached storage devices that hold backups. That is aimed at removing the recovery path, not just the data.
Why it matters. None of the listed flaws are new. Unpatched edge devices and credentials without MFA remain the front door. Blue teams should check every listed CVE against their inventory, and treat VPN logins from Mullvad-associated addresses as a hunting lead.
Mitigation, per the agencies: prioritize fixes for known exploited vulnerabilities, require MFA on all accounts, and keep encrypted, immutable offline backups that are tested regularly. Protect NAS and backup consoles from remote reset. Paying does not guarantee recovery. Victims should report incidents to law enforcement.
For the full indicators and technical detail, read the CISA advisory directly.
