SafePay Ransomware Has Hit 600 Critical Infrastructure Targets, Including Australia

A joint advisory from government agencies in the US, Germany and the UK, including the US Cybersecurity and Infrastructure Security Agency (CISA), says the SafePay ransomware group has compromised at least 600 critical infrastructure organisations. Since emerging in August 2024, the group has affected businesses in North America, South America, Europe and Australia. It has been one of the most active ransomware groups of 2026: NCC Group named it the most active in May 2026, with 70 claimed attacks that month. The group is also believed to be behind the November 2024 attack on US firm Conduent, which led to a large amount of personal and healthcare data being stolen. Conduent agreed to pay $80m to settle a related class action on 16 October 2026.

The advisory, published on 20 October, describes a wide range of ways SafePay gets in. These include exposed credentials, brute force password attacks, exploiting VPN access and exploiting vulnerabilities in edge devices. Once inside, the attackers try to gain administrative privileges on existing or newly created accounts. They then move through the network using built-in administrative tools such as PsExec, WinRM, remote management and monitoring software and remote desktop protocol.

SafePay actors typically disable security software to avoid detection, and have been seen using software packing or virtual machine protection to hide their code. Some researchers believe the group may be a rebrand of other well-known groups, including LockBit, ALPHV/BlackCat and INC Ransomware. The advisory urges security teams to act against this specific threat.