The SafePay ransomware group has breached at least 600 critical infrastructure organizations since launching operations in August 2024, according to a joint security alert released by government cybersecurity agencies from the United States, Germany and the United Kingdom on October 20, 2026. The advisory, authored by the US Cybersecurity and Infrastructure Security Agency (CISA) and its international partners, warns that SafePay's campaign has struck businesses and essential infrastructure across North America, South America, Europe and Australia. The agencies describe SafePay as one of the most prolific ransomware operations active in 2026.

The advisory documents SafePay's rapid ascent in the ransomware landscape. A BlacKite analysis from June 2026 identified the group as the third-busiest ransomware operator during the first four months of 2026, with Germany serving as a primary target. By May 2026, NCC Group ranked SafePay as the single most active ransomware gang worldwide, tallying 70 claimed attacks in that month alone. Security researchers suspect SafePay may represent a rebranding of multiple established ransomware operations including LockBit, ALPHV/BlackCat and INC Ransomware. The group is widely believed responsible for the November 2024 attack on Conduent, a US business services company, which led to the theft of substantial volumes of personal and healthcare information. On October 16, 2026, Conduent settled a class action lawsuit stemming from that breach for $80 million.

The October 20 advisory outlines SafePay's extensive arsenal of intrusion methods, which includes exploiting exposed credentials, launching brute force password attacks, compromising virtual private network access points and taking advantage of security flaws in edge device products. Once attackers establish a foothold, they pursue administrative privileges on both existing and newly established accounts to navigate laterally through networks and reach sensitive systems and information. The threat actors rely on built-in administrative utilities consistent with living off the land tactics, deploying tools such as PsExec, WinRM and remote management and monitoring software, while using remote desktop protocol to broaden their network presence. SafePay operators typically shut down security software to evade detection and have been observed employing software packing or virtual machine software protection to hide their malicious code. To steal data from victim networks, the attackers use legitimate file transfer applications including FileZilla, OneDrive, 7-Zip, RClone and WinRAR, then lock victim files using a complex hybrid encryption combining a ChaCha20 stream cipher with an RSA public-key cryptosystem.

The group operates through a double extortion strategy, leaving ransom notes on compromised systems that inform victims their data has been encrypted and direct them to contact SafePay through a chat portal accessible via a TOR .onion link using a victim ID for authentication. SafePay typically demands a portion of company revenue paid in cryptocurrency in return for decryption software, and representatives phone victims directly to intensify pressure to meet extortion demands. Organizations that refuse payment see their stolen data published on SafePay's leak website, which is referenced in the initial ransom note. The advisory recommends security teams prioritize patching known exploited vulnerabilities, maintain current operating systems and software, enforce identity and access management policies with multi-factor authentication across all accounts, keep offline encrypted backups that are immutable and regularly tested, segment networks to contain ransomware spread, and deploy network monitoring tools to identify and investigate abnormal activity. Organizations must maintain multiple copies of sensitive data and servers in physically separate, segmented and secure locations, with recovery plans covering the entire data infrastructure. The agencies' alert underscores the urgency of defensive action against a threat actor that has demonstrated both technical sophistication and operational aggression across multiple continents. The speed with which SafePay scaled from emergence to market dominance suggests the barrier to entry for destructive cybercrime continues to erode, while the group's hybrid encryption and multi-channel extortion tactics represent an evolution in how ransomware operators extract maximum value from each compromise.