The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), United States Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency, and the United Kingdom’s North West Regional Organised Crime Unit have published a Joint Cybersecurity Advisory regarding the SafePay ransomware group.

This action is part of the #StopRansomware initiative. The SafePay ransomware group has been targeting critical infrastructure sectors across North America, South America, Europe, and Australia. According to the authoring agencies, this group has been one of the most active ransomware groups in 2026.

Key questions the advisory answers:

How do SafePay actors breach networks? They obtain access by utilizing virtual private network provider IP addresses. They also use means like stealing or guessing passwords and other phishing techniques. They target: CVE-2020-3259 [Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor], CVE-2023-20269 [CWE-288: Authentication Bypass Using an Alternate Path or Channel], CVE-2023-27532 [CWE-306: Missing Authentication for Critical Function], CVE-2024-40711 [CWE-502: Deserialization of Untrusted Data], and CVE-2024-40766 [CWE-284: Improper Access Control].

What happens if an actor gains access to a network? Once in, the actors will use existing accounts in the network or create new accounts to get administrative access. They leverage living off the land (LOTL) techniques and other tools to move through the network and exploit information undetected. Victims will lose access to their files unless they pay amounts the actors demanded in cryptocurrency.

What can leaders do to keep their networks safe? The advisory lists several actions organizations can take to safeguard networks, such as:

• Keeping up with device and security maintenance
• Severely restricting administrative access
• Using longer passwords
• Ensuring identity, credential, and access management (ICAM) policies and multifactor authentication (MFA) are used by everyone
• Enforcing the “Zero Trust Principle”

Why is this information important to know? There are more than 600 known victims of SafePay ransomware group, including healthcare networks. Cyber incidents in the healthcare sector can lead to outages, disrupt patient care, compromise patient information, and ultimately put patients at risk.

A full list of known SafePay ransomware group actions, along with safety strategies and what to do if you suspect your network has been compromised can be found in the advisory.