FBI, CISA Name SafePay Ransomware Group in Joint Advisory Covering 600-Plus Victims

Federal and international law enforcement agencies went public Monday with a detailed technical advisory on SafePay, a ransomware group that has logged at least 600 confirmed victims since it surfaced in August 2024. The document, advisory AA26-293A under the government's standing StopRansomware banner, is worth reading carefully, because the headline number obscures an important qualifier.

The advisory says SafePay "has impacted at least 600 separate victims from multiple critical infrastructure sectors." That's not the same as saying 600 critical infrastructure operators were hit. As a technical analysis reviewed at safeguard.sh noted, the wording covers victims drawn from those sectors, and the advisory itself does not name which sectors. Regions are specified: North America, South America, Europe, and Australia. The 600 figure should be read as a floor, since ransomware leak sites only publish names of organizations that refuse to pay.

The co-signers are worth noting. The advisory was issued by the FBI, CISA, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency, and the UK's North West Regional Organised Crime Unit, according to the advisory text reviewed at ic3.gov. Investigations feeding the document ran through August 2026.

On the technical side, the entry vectors SafePay uses aren't novel. According to advisory AA26-293A, the group gets in through stolen or guessed passwords, brute-force attacks, phishing, and exploitation of VPN access and internet-facing edge devices. Once inside, it moves laterally using tools already present on Windows networks, then targets backup systems specifically to obstruct recovery. The advisory notes that the five CVEs it lists were all disclosed in 2024 or earlier. That's not a footnote; it's the story. A group that's racked up 600-plus victims over two years is doing it through flaws that have had patches available the entire time.

FBI Cyber Division Assistant Director Brett Leatherman, quoted in coverage by shattered.io, framed the advisory as a practical tool for defenders rather than a general warning, a framing the agencies have used before but one that rings truer here given the step-by-step intrusion chain the document walks through.

The SafePay advisory lands two weeks after a separate, heavier advisory from the same core agencies. On October 8, CISA, the FBI, and the NSA, joined by partners from the UK, Australia, Canada, Japan, New Zealand, and Spain, published advisory AA26-281A naming Integrity Technology Group, a China-based company the agencies tie to the Chinese government, as an enabler of intrusions into government, critical manufacturing, healthcare, and IT sectors. According to the CISA press release reviewed on cisa.gov, those actors are tracked in industry reporting under the cluster names Flax Typhoon, Ethereal Panda, and Red Juliett. CISA's acting executive assistant director for cybersecurity, Chris Butera, said the goal is pre-positioning: access held in reserve to "disrupt critical functions at a future time of their choosing." That's an assessment, not a confirmed operational order, and the advisory is careful to frame it as one.

Taken together, the two advisories sketch a two-track threat environment hitting the same target set: financially motivated actors exploiting old, unpatched vulnerabilities, and state-enabled actors doing patient, stealthy access operations through the same edge-device seams. The mitigations the agencies recommend in both documents are nearly identical. Patch known-exploited CVEs on internet-facing systems. Enforce multi-factor authentication on VPNs, webmail, and privileged accounts. Segment backups off the main network. That convergence is either reassuring or alarming depending on your organization's patching cycle.

Sources cited:
- CISA Advisory AA26-293A (#StopRansomware: SafePay Ransomware) (https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a)
- IC3 Advisory AA26-293A PDF (https://www.ic3.gov/CSA/2026/261020.pdf)
- safeguard.sh, AA26-293A analysis (https://safeguard.sh/resources/blog/safepay-ransomware-cisa-advisory)
- shattered.io, SafePay advisory coverage (https://shattered.io/safepay-ransomware-fbi-cisa-advisory-600-firms-2026/)
- CISA, Integrity Technology Group advisory press release (https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat)
- safeguard.sh, AA26-281A Integrity Tech analysis (https://safeguard.sh/resources/blog/china-linked-integrity-tech-aa26-281a-advisory-october-2026)