CISA and FBI Issue Alert on SafePay Ransomware
The joint advisory details threats from a group that has compromised hundreds of critical infrastructure organizations.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Do you trust that major organizations are doing enough to protect critical infrastructure from ransomware?
The Cybersecurity and Infrastructure Security Agency and the FBI issued a joint advisory regarding the SafePay ransomware operation. Since emerging in August 2024, the group has compromised at least 600 critical infrastructure organizations globally.
Why it matters
SafePay employs a sophisticated double-extortion model that leverages both data leaks and ransom demands calibrated to victim revenue. This operation highlights the persistent threat to critical infrastructure from groups utilizing aggressive lateral movement techniques.
SafePay encrypts files using a hybrid ChaCha20 and RSA scheme. Affiliates gain network access through stolen credentials, brute-force attacks, VPN abuse, and the exploitation of edge device vulnerabilities.
The players
CISA
The Cybersecurity and Infrastructure Security Agency is a United States federal agency tasked with protecting the nation's critical infrastructure from physical and cyber threats.
FBI
The Federal Bureau of Investigation is the domestic intelligence and security service of the United States and its principal federal law enforcement agency.
Conduent
Conduent is a global business process services and solutions company that provides digital platforms for businesses and governments.
The details
Attackers move laterally within compromised networks using tools like PsExec, WinRM, RDP, and remote monitoring software. The group was previously linked to a 2024 attack on Conduent, which ultimately led to an $80 million class-action settlement in October 2026.
Timeline
The SafePay ransomware operation first emerged in August 2024.
CISA and the FBI published their joint advisory on October 20, 2026.
A class-action settlement related to a prior attack was reached in October 2026.
The Tech Race
This advisory follows the pattern set by the 2024 attack on Conduent, linking the current ransomware group to the same historical threat pattern. The shift toward double-extortion tactics marks a significant evolution in how criminal groups extract value from infrastructure entities.
Organizations should monitor for unauthorized use of remote management software and secure all edge devices to prevent potential lateral movement. Businesses must remain vigilant against stolen credentials, as these remain a primary entry point for large-scale ransomware operations.
The takeaway
The SafePay operation demonstrates how ransomware groups have standardized the use of high-impact extortion methods. Organizations should audit their network access protocols and review their reliance on remote management tools to harden their defense against similar attacks.
Further reading
Learn more about emerging digital threats on our Cybersecurity page.
Source note: This article includes information reported by Computer Crime Research Center.
Live Poll
Do you trust that major organizations are doing enough to protect critical infrastructure from ransomware?
