SafePay ransomware gang hits more than 600 organisations, warn US, UK and German agencies

At least 600 organisations across the US and Europe have been breached by the SafePay ransomware gang since August 2024, according to a new advisory from the FBI and cybersecurity agencies in Germany and the UK. The agencies describe SafePay as "among the most active ransomware groups in 2026". It targets businesses and critical infrastructure by guessing passwords, exploiting software vulnerabilities and using phishing attacks. The group also uses automated scripts to find vulnerable systems exposed to the internet, and the advisory lists several known vulnerabilities it has used.

Once inside a network, the attackers create new accounts or take over existing ones. They then use legitimate system tools to move around, find valuable files and switch off security protections to avoid detection. In some cases they change user passwords to make it harder for staff to log in and stop the activity. Data is compressed and copied out before the ransomware is deployed, and remote desktop tools such as AnyDesk or TeamViewer are used to transfer the ransomware onto victim systems.

Victims are asked to pay a subset of company revenue in cryptocurrency for the decryption key. To add pressure, a representative phones the victim on the group's behalf. The group's leak site lists dozens of German companies and government organisations in Latin America and the US, and it has recently claimed attacks on Microlise and Conduent. Experts have previously noted that parts of SafePay's code resemble LockBit.