bleeping-computer · Crawled Oct 22, 2026

CISA: SafePay ransomware hit over 600 critical infrastructure orgs

1 IoCs 1 Malware
Read original article ↗

AI Summary

The Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies have identified SafePay, a private ransomware group active since August 2024, as responsible for breaching over 600 critical infrastructure organizations globally. The group gains initial access through credential exposure, brute force attacks, and exploitation of VPN vulnerabilities, particularly targeting Mullvad VPN IP addresses. SafePay employs double-extortion tactics, exfiltrating sensitive data before encryption and threatening to leak it if ransoms are unpaid. The group does not use affiliates and has increasingly filled the operational gap left by the decline of BlackCat and LockBit ransomware groups.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware SafePay →

Indicators of Compromise 1 extracted

Type Value Detail
Domain mullvad[.]net Details →

MITRE ATT&CK TTPs 5 techniques

T1078 Valid Accounts · Defense Evasion T1110 Brute Force · Credential Access T1210 Exploitation of Remote Services · Lateral Movement T1485 Data Destruction · Impact T1566 Phishing · Initial Access