SafePay ransomware: 600+ victims across US and Europe since August 2024 per FBI advisory
Severity: high · Patch status: no-fix-needed · Since 2026-10-27
The FBI, alongside Germany's BSI and the UK's NCSC, issued a joint advisory stating that the SafePay ransomware gang has breached at least 600 organizations across the U.S. and Europe since August 2024, making it one of the most active ransomware groups currently operating. The advisory is intended to help organizations recognize indicators of compromise and defend against the group's tactics, techniques, and procedures. No specific victim names, CVE, or technical exploitation details are given in the source excerpt. As a criminal campaign rather than a product vulnerability, there is no vendor patch; mitigation relies on standard ransomware defenses and applying the advisory's IOC guidance.
What to do
- Review the joint FBI/BSI/NCSC advisory and hunt for SafePay indicators of compromise in your environment
- Verify offline, tested backups and confirm ransomware recovery procedures
- Enforce MFA, restrict RDP/remote access, and segment networks to limit lateral movement
- Patch internet-facing systems and monitor for unusual encryption activity or data exfiltration
- Report suspected SafePay incidents to law enforcement (FBI/IC3 or national CERT)
Sources
All live incidents on Threat Watch
