What We Know
The FBI, CISA, U.K. and German law-enforcement agencies say SafePay ransomware actors have compromised more than 600 victims, including organizations in multiple critical-infrastructure sectors, and describe the group as one of the most active ransomware threats.3Backed by 3 sourcescisa.govtherecord.mediaBleepingComputer The reported access routes include stolen VPN credentials and vulnerabilities in edge devices and backup servers, with reporting specifically identifying Cisco, Veeam and SonicWall-related flaws.2Backed by 2 sourcesctipilot.chdefenderdaily.com
After gaining access, the actors use tools and remote-management methods including PsExec, Windows Remote Management and RClone to move through environments, transfer data or otherwise support the intrusion.1Backed by 1 sourcessoctember.com The campaign also targets backup infrastructure: the advisory accounts describe SafePay operators factory-resetting network-attached storage devices before encrypting systems, a tactic that can undermine recovery options.2Backed by 2 sourcessoctember.comctipilot.ch
Agencies warned that software flaws patched in 2024 remained an access route for SafePay.1Context from one sourcetechnology.org The headline independently frames the campaign as having targeted hundreds of victims during the year, but does not provide the briefing’s full figure or broader characterization.1Context from one sourcestreetinsider.com
Source Comparison
Aligned reportingCorroborates
- soctember.com↗Its title directly supports the reported use of PsExec, WinRM and RClone, along with factory-resetting backup storage.
- cisa.gov↗The agency advisory title supports the account that SafePay actors targeted multiple critical-infrastructure sectors.
- ctipilot.ch↗Its title supports the reported entry through VPN credentials and edge-device or backup-server flaws, as well as factory-resetting backup NAS devices before encryption.
- therecord.media↗The headline supports the reported scale and characterization of SafePay as among the most active ransomware groups, while attributing the assessment to the FBI.
- BleepingComputer↗Its headline supports the report that SafePay breached more than 600 organizations identified as critical infrastructure.
- defenderdaily.com↗The title directly supports the reported identification of Cisco, Veeam and SonicWall flaws as SafePay access vulnerabilities.
Adds context
- streetinsider.com↗The headline independently frames the campaign as having targeted hundreds of victims during the year, but does not provide the briefing’s full figure or broader characterization.
- technology.org↗The article headline adds that agencies warned about SafePay’s scale and that software flaws patched in 2024 remained an access route, without detailing the briefing’s named products.