The FBI says SafePay ransomware has hit more than 600 victims since 2024

SafePay, a ransomware group the FBI now ranks among the most active in 2026, has hit more than 600 victims across the United States and Europe since August 2024. The FBI made the count public alongside cybersecurity agencies in Germany and the United Kingdom, and the figure comes from a joint advisory that The Record covered on Oct. 20.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

The number matters less as a trophy tally than as a signal about method. SafePay does not rely on one clever exploit; it combines guessed passwords, known software bugs and phishing, then spends time inside a network before anyone notices the encryption.

What the agencies counted and who wrote the advisory

As The Record reported, the agencies describe SafePay as among the most active ransomware groups in 2026, with more than 600 victims since 2024; the article’s body puts the count at at least 600 organizations across the United States and Europe. The advisory is based on investigations by the FBI and German law enforcement, and The Record links it as CISA advisory AA26-293A. The reporter did not name the German and British agencies involved, and the most recent incident cited in the advisory occurred in August.

SafePay’s leak site, where it names victims, lists dozens of German companies and government organizations as well as targets across Latin America and the United States. Experts told The Record that parts of its code resemble LockBit, a once-dominant operation that has largely collapsed, and The Record points readers to its earlier coverage of ransomware takedowns and proliferation for that background. Such overlap is common when affiliates move between groups, though the advisory material described by The Record does not say whether SafePay’s operators are former LockBit members.

Getting in: passwords, patches and phishing

The agencies say SafePay actors gain initial access by guessing passwords, exploiting vulnerabilities and phishing, and they use automated scripts that scan internet-exposed systems for flaws. The advisory lists CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766, plus others. Two of those, CVE-2023-27532 and CVE-2024-40711, are Veeam backup software flaws that The Record has covered as exploited in ransomware attacks and added to the CISA catalog, while CVE-2024-40766 is a SonicWall firewall vulnerability the outlet tracked in its reporting on suspected zero-day attacks on Gen 7 firewalls.

The common thread in the named flaws is network edge equipment and backup software, the places where one unpatched server can hand an intruder a route to everything behind it. Because the agencies say the actors also guess passwords and phish, patching alone would not close every door, and the same reporting says the group works from scripts that scan the internet continuously for whatever is exposed.

Inside the network and the pressure campaign

Once inside, the agencies say, SafePay actors establish control by creating new accounts or taking over existing ones. They use legitimate system tools to move through the network, find valuable files and disable security protections, and they change user passwords so that victims cannot log back in. Files are compressed with legitimate tools and copied out before the ransomware is deployed, and remote desktop tools such as AnyDesk or TeamViewer are used to transfer the malware to victim machines.

The extortion step is unusually personal. The advisory says the group demands a subset of company revenue in cryptocurrency in exchange for the decryption key, and that to put pressure on the victim, a representative makes phone calls on behalf of the ransomware group. A ransom note backed by a human voice is designed to shorten the time an executive spends deliberating.

Victims the group has claimed

The Record lists several high-profile intrusions attributed to the gang. One is the July 2025 attack on Ingram Micro, a major U.S. IT products and services provider; the company said it found ransomware on certain of its internal systems and took them offline, disrupting order processing and shipping, though Ingram did not name an attacker and the SafePay attribution came from later reporting by BleepingComputer. Another is the British technology company Microlise.

A third is the government technology contractor Conduent. A January 2025 outage tied to a third-party compromise disrupted child support payments in Wisconsin and programs in other states, as described in The Record’s report on the outage, and the company recently announced an $80 million settlement in a class action over the attack. Conduent did not say at the time whether ransomware was involved or whether data had been stolen.

For defenders, the practical reading of the advisory is narrow and unglamorous: patch the listed vulnerabilities on exposed systems, watch for new accounts and remote desktop tools that nobody installed, and treat an unexpected phone call about a ransom as part of the attack, not a courtesy. The Record’s article itself does not include mitigation guidance, so the full recommendations sit in the advisory text, which could not be opened for this report.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.