Overview
- The joint advisory published on October 20, 2026, says SafePay has affected at least 600 critical infrastructure organizations worldwide since August 2024.
- Agencies say SafePay gains entry through exposed credentials, brute‑force attacks and exploited VPN or edge‑device flaws and has repeatedly used IP addresses tied to the Mullvad VPN service.
- After compromise the group uses built‑in admin tools such as PsExec, WinRM and RDP to move laterally, exfiltrates data with legitimate file‑transfer tools, and encrypts files with a ChaCha20/RSA hybrid scheme.
- The advisory lists IOCs and maps tactics to MITRE ATT&CK while urging defenders to enable MFA, enforce identity and access controls, patch known exploited vulnerabilities, restrict admin privileges, and keep offline immutable backups.
- Officials warn paying ransoms may not restore files and urge reporting to law enforcement; the October settlement by Conduent highlights the real financial and legal costs victims can face after breaches.