SafePay Ransomware Group Breaches 600 Global Organizations
The group exploits known software vulnerabilities and remote desktop tools to extort companies across two continents.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust that large companies are doing enough to protect your data from ransomware attacks?
The SafePay ransomware group has compromised 600 organizations across the United States and Europe since August 2024. The threat actors exploit specific software vulnerabilities and use legitimate remote desktop software to deploy ransomware.
Why it matters
The group demonstrates how threat actors leverage common software vulnerabilities and standard administrative tools to extort company revenue. This approach forces organizations to address both technical patching cycles and incident response protocols.
SafePay exploits vulnerabilities including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766. The group utilizes AnyDesk and TeamViewer for data exfiltration and ransomware deployment.
The players
SafePay
A ransomware group that targets business and critical infrastructure through phishing, credential harvesting, and software exploitation.
Conduent
A business process services company that provides technology and administrative support to government and commercial clients.
Microlise
A technology provider specializing in telematics and transport management software that was targeted by SafePay.
The details
The group gains network control via password guessing, phishing, or exploiting known CVEs (Common Vulnerabilities and Exposures — standard identifiers for publicly disclosed cybersecurity flaws). Once inside, attackers use legitimate remote desktop tools to compress files and exfiltrate data. Representatives then contact victims via phone to demand cryptocurrency payments calculated as a percentage of the entity's total revenue.
Timeline
August 2024: SafePay initiated a wave of 600 organization breaches.
August 2026: Law enforcement investigated the most recent incident.
October 16, 2026: Conduent announced an $80 million class action settlement.
The Tech Race
SafePay follows a pattern set by the recent trend of using remote-tool exploitation to conduct unauthorized data exfiltration. This tactic marks a departure from custom malware-heavy approaches by favoring legitimate administrative tools to avoid detection.
Organizations must urgently patch listed CVEs to prevent account takeover and unauthorized access. Businesses should also monitor for unauthorized instances of remote desktop tools like TeamViewer and AnyDesk within their network environments.
The takeaway
Organizations should prioritize securing remote desktop tools and addressing the specific CVEs identified in these breaches. Monitoring for anomalous phone-based pressure tactics may provide early warning of an active extortion attempt.
Further reading
For broader trends in ransomware tactics, see the latest updates in Cybersecurity.
Live Poll
Do you trust that large companies are doing enough to protect your data from ransomware attacks?
