SafePay Ransomware Group Breaches 600 Organizations
The group has targeted businesses and infrastructure across the U.S. and Europe since August 2024.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust that large companies are doing enough to protect your data from ransomware attacks?
Since August 2024, the SafePay ransomware group has successfully breached at least 600 organizations in the United States and Europe. The actors utilize password guessing, phishing, and software vulnerabilities to extort revenue through cryptocurrency demands.
Why it matters
The group exerts pressure on victims through direct phone calls and leverages legitimate remote desktop software to exfiltrate sensitive data. This campaign highlights the ongoing risks organizations face from attackers using both legacy vulnerabilities and common administrative tools.
SafePay exploits known vulnerabilities including CVE-2020-3259 and CVE-2024-40766 to gain network control. Once inside, they use tools like AnyDesk and TeamViewer to compress and transfer stolen files.
The players
SafePay
This is a ransomware group known for targeting critical infrastructure and businesses through extortion.
Conduent
This is a government contractor and business process services company that was targeted by the group.
Microlise
This is an IT provider that has also been subjected to attacks by the SafePay group.
The details
Hackers systematically gain access to corporate and government networks by exploiting known software flaws and phishing campaigns. Once they establish a foothold, they use remote desktop software to control systems and hold data for ransom based on a percentage of the victim company's revenue.
Timeline
August 2024: SafePay began its campaign of 600 organization breaches.
August 2026: Law enforcement investigated the most recent incident.
October 16, 2026: Conduent announced an $80 million settlement.
The Tech Race
The SafePay campaign represents a departure from traditional automated attacks by incorporating aggressive manual pressure tactics like direct phone calls. It highlights a shift in the cyber arms race where attackers increasingly leverage legitimate administrative software to evade detection.
Organizations must prioritize patching specific vulnerabilities like CVE-2024-40711 to mitigate unauthorized network access. Employees should remain alert for phishing attempts as attackers continue to use compromised user accounts to establish initial control.
The takeaway
Companies should perform regular audits of remote desktop tools to ensure they are not being used by unauthorized third parties. Implementing multi-factor authentication can significantly disrupt the password guessing tactics used by groups like SafePay.
Further reading
For more information on the evolving threat landscape, see the latest Cybersecurity reports.
Live Poll
Do you trust that large companies are doing enough to protect your data from ransomware attacks?
