Government Advisory

CISA Warns Australian Businesses Are Among Targets of Active SafePay Ransomware Group

CISA · 20 Oct 2026

Key Takeaway Patch the vulnerabilities named in the advisory, use strong unique passwords with multi-factor authentication, and train staff to spot phishing to close the main ways SafePay gets in.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory on the SafePay ransomware group. SafePay has been highly active since August 2024 and targets businesses and critical infrastructure in North America, South America, Europe and Australia.

According to the advisory, SafePay actors typically get in by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing. The advisory lists five vulnerabilities in its affected products: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766.

Once inside, the attackers create new accounts or take over existing ones to keep control. They then use legitimate system tools to move through the network, find valuable files and disable security protections to avoid detection. Finally, they encrypt the victim's files and leave a ransom note demanding payment in cryptocurrency. CISA urges organisations to follow its recommended security measures to reduce the risk and impact of these attacks.

ransomware SafePay CISA vulnerabilities phishing

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.