SafePay Ransomware Has Breached 600+ Critical Infrastructure Organizations: What Security Teams Must Do Now
Executive Summary
Since August 2024, the SafePay ransomware group has breached more than 600 critical infrastructure organizations across North America, South America, Europe, and Australia. Operating as a private, affiliate-free group, SafePay gains initial access through credential exposure, brute-force attacks, and exploitation of VPN edge devices—particularly leveraging Mullvad VPN IP addresses and phished account profiles. Once inside, actors perform double-extortion: exfiltrating sensitive data before encrypting systems, then threatening public release if ransoms go unpaid. Recovery is further undermined by deliberate deletion of shadow copies and wiping of network-attached storage backups. A joint advisory from CISA, FBI, USSS, and international partners was published October 21, 2026.
SafePay has rapidly filled the vacuum left by dismantled ransomware operations such as BlackCat (ALPHV) and LockBit, emerging as one of the most active ransomware threats globally. With valid credentials bypassing prevention controls in 63% of post-access scenarios, the incident underscores escalating risks tied to identity abuse, VPN exploitation, and insufficient lateral movement controls across hybrid and cloud environments.
Why This Matters Now
CISA's October 2026 advisory confirms SafePay is actively targeting critical infrastructure sectors with VPN exploitation and credential abuse at scale. With over 600 confirmed victims in roughly two years and prevention controls failing after initial access, organizations face an urgent window to enforce lateral movement controls, egress filtering, and zero-trust segmentation before the next wave of attacks.
Attack Path Analysis
SafePay ransomware actors gained initial access to critical infrastructure organizations through credential exposure, brute force attacks, phished account profiles, and exploitation of VPN and edge device vulnerabilities, frequently leveraging Mullvad VPN IP addresses to obscure origin. After establishing a foothold with valid credentials, attackers escalated privileges by abusing administrative tools and IAM weaknesses, then moved laterally across network segments to reach high-value systems and backup infrastructure. Command and control was maintained through covert channels and automated scripting, while sensitive data was exfiltrated prior to encryption as part of a double-extortion strategy. The attack concluded with ransomware deployment, shadow copy deletion, and NAS backup destruction to maximize impact and impair recovery.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
SafePay actors gained initial access through multiple vectors: exposed or brute-forced VPN credentials (particularly via Mullvad VPN IPs), phished account profiles, and exploitation of known CVEs affecting edge devices including VPNs and firewalls. Automated scripts were used to scan for and exploit internet-exposed systems listed in CISA's KEV catalog. The Cloud Native Security Fabric (CNSF) inline enforcement and Cloud Firewall (ACF) capabilities could have blocked automated exploit traffic and restricted inbound access from known malicious IP ranges, reducing the attack surface exposed to these initial access techniques.
MITRE ATT&CK® Techniques
Valid Accounts
Brute Force
External Remote Services
Phishing
Exploit Public-Facing Application
Inhibit System Recovery
Data Encrypted for Impact
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Authenticator Management, Remote Access, and Flaw Remediation
Control ID: IA-5, AC-17, SI-2
PCI DSS 4.0 – Multi-Factor Authentication, Vulnerability Management, and Incident Response
Control ID: Requirement 8.4, Requirement 6.3, Requirement 12.10
NYDFS 23 NYCRR 500 – Chief Information Security Officer, Access Privileges, and Multi-Factor Authentication
Control ID: 500.4, 500.7, 500.12
DORA (Digital Operational Resilience Act) – ICT Security Controls, Backup and Recovery, and ICT-Related Incident Reporting
Control ID: Article 9, Article 11, Article 17
NIS2 Directive – Risk Management, Incident Handling, and Supply Chain Security
Control ID: Article 21(2)(a), Article 21(2)(b), Article 21(2)(e)
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Identity Verification and Micro-Segmentation
Control ID: Identity Pillar – Advanced, Network Pillar – Initial/Advanced
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
SafePay ransomware directly targets critical infrastructure, with CISA confirming 600+ breaches. VPN exploitation, credential theft, and shadow copy deletion threaten continuity of essential government operations and public services.
Health Care / Life Sciences
As a primary critical infrastructure sector, healthcare faces SafePay double-extortion via VPN exploits and lateral movement, risking HIPAA violations, patient data exfiltration, and encrypted system downtime endangering lives.
Utilities
Utilities represent high-value critical infrastructure targeted by SafePay through brute-force VPN attacks and automated CVE exploitation, where ransomware-encrypted OT systems and deleted backups can cause widespread service disruptions.
Financial Services
SafePay's credential-based initial access and double-extortion tactics expose financial institutions to encrypted system outages and sensitive data leaks, triggering PCI 4.0 and NIST 800-53 compliance failures and regulatory penalties.
Sources
- CISA: SafePay ransomware hit over 600 critical infrastructure orgshttps://www.bleepingcomputer.com/news/security/cisa-and-fbi-safepay-ransomware-has-hit-over-600-critical-infrastructure-organizations/Verified
- CISA Cybersecurity Advisory AA26-293A: SafePay Ransomwarehttps://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293aVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- SafePay Ransomware: The Fast-Rising Threat Targeting MSPshttps://www.acronis.com/en-sg/tru/posts/safepay-ransomware-the-fast-rising-threat-targeting-msps/Verified
- FBI and CISA Joint Advisory on Ransomware Trends and Critical Infrastructure Threatshttps://www.cisa.gov/stopransomwareVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because SafePay actors exploited uncontrolled inbound access, flat internal networks, and unrestricted outbound paths to move freely across segmented infrastructure. Enforcing identity-aware segmentation and controlled egress at the network fabric level would likely have reduced attacker reachability across each stage of the kill chain.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline enforcement at the network fabric level could likely reduce the reachability of automated exploit traffic and constrain inbound access attempts originating from known malicious or anonymizing IP infrastructure, limiting the attack surface available to these initial access techniques.
Control: Zero Trust Segmentation
Mitigation: Identity-based segmentation policies would likely constrain the scope of privilege escalation by limiting which resources an authenticated identity can reach, reducing how far compromised credentials could carry an attacker across the environment.
Control: East-West Traffic Security
Mitigation: Microsegmentation enforced on east-west traffic flows would likely reduce workload-to-workload reachability, constraining the attacker's ability to pivot from an initial foothold toward backup infrastructure and sensitive data stores without explicit policy authorization.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across the cloud control plane would likely surface anomalous outbound connection patterns associated with covert C2 activity, reducing the window in which attacker-controlled channels could operate undetected across the environment.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN-based egress filtering would likely constrain outbound data transfers to unauthorized external destinations, reducing the volume of sensitive data that could be exfiltrated before encryption activity begins.
If prior segmentation and egress controls had constrained lateral movement and limited attacker reach to backup infrastructure, the ransomware deployment would likely have affected a narrower set of workloads, reducing overall operational disruption and preserving at least partial recovery options.
Impact at a Glance
Affected Business Functions
- Critical Infrastructure Operational Technology (OT) and Industrial Control Systems (ICS)
- Network-Attached Storage (NAS) and Backup and Recovery Services
- VPN and Remote Access Infrastructure
- IT Service Continuity and Incident Response Operations
Estimated downtime: 18 days
Estimated loss: N/A
Sensitive documents and proprietary data stolen from over 600 critical infrastructure organizations across North America, South America, Europe, and Australia prior to encryption. Exposed data categories likely include operational technology configurations, employee PII, internal financial records, government-adjacent data, healthcare records (depending on sector), and supply chain documentation. Double-extortion tactics confirm exfiltration occurred before encryption in all victim engagements where ransom was not paid, with stolen data threatened for public release on the group's dark web leak site.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Zero Trust Segmentation with identity-based SmartGroup policies to implement least-privilege access controls across all workloads, preventing lateral movement and limiting attacker reach to backup and NAS infrastructure after initial credential compromise.
- • Deploy Egress Security and Policy Enforcement with FQDN filtering on all outbound traffic to block data exfiltration to unauthorized destinations and disrupt SafePay double-extortion data theft before encryption is deployed.
- • Enable Multicloud Visibility and Control with centralized traffic observability and anomaly detection to surface covert C2 communications, automated scripting activity, and anomalous east-west flows indicative of post-compromise lateral movement.
- • Implement East-West Traffic Security controls to enforce microsegmentation on internal workload-to-workload and service-to-service communication, containing the blast radius of ransomware deployment and preventing attackers from reaching backup systems.
- • Deploy Cloud Firewall (ACF) and Inline IPS (Suricata) to block inbound exploit traffic targeting VPN and edge device CVEs at the perimeter, and to detect and block known ransomware payload signatures and malicious exfiltration traffic patterns in real time.
