FBI: SafePay Ransomware Gang Breached Over 600 Organizations Since 2024

SafePay's Activity and Targets

International law enforcement agencies, including the FBI and cybersecurity bodies in Germany and the U.K., released an advisory detailing the activities of the SafePay ransomware group. The group has reportedly breached more than 600 organizations across the U.S. and Europe since August 2024, making it one of the most active ransomware groups.

SafePay primarily targets businesses and critical infrastructure. Their methods include guessing passwords, exploiting known vulnerabilities such as CVE-2020-3259 and CVE-2024-40711, and conducting phishing attacks. The advisory is based on multiple investigations by the FBI and German law enforcement.

Attack Methodology

Once inside a network, SafePay actors establish control by creating new accounts or taking over existing ones. They use legitimate system tools to move laterally, identify valuable files, and disable security protections to avoid detection. Automated scripts are also used to target vulnerabilities in internet-exposed systems.

The group sometimes changes user passwords to hinder victim response. They compress and exfiltrate files before deploying ransomware, often using remote desktop tools like AnyDesk or TeamViewer to transfer the malware onto victim systems.

Ransom Demands and Pressure Tactics

SafePay typically encrypts data and demands a ransom in cryptocurrency, calculated as a subset of the victim company's revenue. To pressure victims, a representative makes phone calls on behalf of the ransomware group.

The group's leak site lists numerous German companies and government organizations in Latin America and the U.S. SafePay has claimed responsibility for attacks on a major U.S. IT products provider, British tech company Microlise, and government technology contractor Conduent, with the latter causing significant disruption due to its role in Medicaid.