WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), U.S. Secret Service (USSS), and international partners released a joint Cybersecurity Advisory, #StopRansomware: SafePay Ransomware , that warns organizations of one of the most active ransomware group in 2026, impacting approximately 600 victims across sectors in the Americas, Europe and Australia. To help organizations protect against this group, the advisory provides observed tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs) and recommended mitigations.

SafePay actors gain access to victim networks by compromising credentials and targeting known vulnerabilities in internet-facing devices, often connecting through virtual private network (VPN) services. Once inside, they use legitimate IT tools to move through networks and undermine recovery by deleting or disabling backups.…