The SafePay ransomware group has compromised at least 600 critical infrastructure organizations across North America, South America, Europe and Australia, based on information published by Infosecurity Magazine.
Since emerging in August 2024, SafePay has become one of the most active ransomware threats. The group utilizes diverse initial access vectors, including credential exposure, brute force attacks, virtual private network exploitation and vulnerabilities in edge devices. Once inside, attackers use living off the land techniques, such as PsExec and remote management software, to gain administrative privileges and move laterally. The group employs a double extortion model, exfiltrating sensitive data before locking systems with hybrid encryption. Victims are pressured through ransom notes and direct phone calls. If demands are not met, stolen data is published on a leak site. SafePay is suspected to be a rebrand of previous groups like LockBit and ALPHV/BlackCat. The Cybersecurity and Infrastructure Security Agency advises organizations to implement multifactor authentication, maintain offline backups, segment networks and prioritize the remediation of known exploited vulnerabilities to mitigate these risks. The group’s impact is significant, evidenced by a recent $80 million settlement involving a major business services firm following a 2024 data breach.
Source: Infosecurity Magazine
