FBI, U.K. and German agencies issue SafePay ransomware advisory

The FBI, German cybersecurity agencies and U.K. cybersecurity agencies issued a joint advisory on the SafePay ransomware gang, attributing more than 600 victim organizations in the U.S. and Europe to the group since August 2024.

The Record reported the advisory. The agencies characterized SafePay as a leading ransomware cartel in 2026. The advisory drew on many FBI and German law enforcement investigations into SafePay, including the most recent incident in August.

SafePay goes after businesses and critical infrastructure through password guessing, vulnerability exploitation and phishing attacks. The advisory lists vulnerabilities used in SafePay attacks including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, among others. SafePay uses automated scripts to target vulnerabilities across internet-exposed systems.

“Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones,” the agencies said. The gang uses legitimate system tools to move through networks, identify valuable files and disable security protections. In some cases, SafePay changes users’ passwords to block login and stop activity.

SafePay uses legitimate tools to compress and exfiltrate files before deploying ransomware on victim devices. SafePay relies on legitimate remote desktop tools like AnyDesk or TeamViewer to get ransomware onto victim computers. According to the advisory, SafePay generally keeps encrypted data hostage and asks for a portion of company revenue in cryptocurrency in exchange for the decryption key. A SafePay representative makes phone calls to pressure victims on the cartel’s behalf.

SafePay recently claimed credit for an attack on Conduent, a government technology contractor. The attack caused significant U.S. damage because of Conduent’s role in services such as Medicaid, child support and food assistance. Conduent also handles roadway tolls. Conduent announced an $80 million settlement last Friday in response to a class action lawsuit filed after the ransomware attack.

SafePay recently claimed credit for an attack on Microlise, a British tech company described as one of the U.S.’s biggest providers of IT products and services. The gang’s leak site currently lists dozens of German companies and government organizations across Latin America and the U.S. Experts have said parts of SafePay’s code resemble LockBit, a largely defunct ransomware operation responsible for hundreds of attacks.