SafePay Ransomware Targets Global Critical Infrastructure
A new CISA and FBI advisory outlines the group's tactics for lateral movement across enterprise networks.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Do you trust that major organizations are doing enough to protect critical infrastructure from ransomware?
CISA and the FBI have issued a joint advisory detailing the tactics of the SafePay ransomware group. The operation, which emerged in August 2024, has impacted at least 600 critical infrastructure organizations globally.
Why it matters
The rise of SafePay signals a shift toward revenue-indexed ransom demands and double-extortion strategies that threaten global critical infrastructure. Security teams must now account for the group's specific methodology of leveraging existing remote management tools for lateral movement.
SafePay employs a hybrid encryption scheme utilizing ChaCha20, a stream cipher, and RSA, an asymmetric cryptographic algorithm. This hybrid approach allows the ransomware to maintain high-speed file encryption while ensuring secure key management.
The players
CISA
The Cybersecurity and Infrastructure Security Agency is the primary U.S. federal body responsible for protecting national infrastructure against digital threats.
FBI
The Federal Bureau of Investigation leads domestic counter-intelligence and investigations into sophisticated cybercriminal ransomware syndicates.
Conduent
A business process services provider that previously experienced a major infrastructure compromise linked to the SafePay operation.
The details
Affiliates gain initial network entry through stolen credentials, brute-force attacks, and exploitation of vulnerabilities in edge devices or virtual private networks (VPNs). Once inside, the group moves laterally using standard administrative tools such as PsExec, a command-line utility for executing processes on remote systems, and Windows Remote Management (WinRM). They also leverage Remote Desktop Protocol (RDP) and common remote monitoring and management (RMM) software to maintain persistent access before deploying encryption.
Timeline
August 2024: SafePay ransomware operation first emerged.
October 20, 2026: CISA and the FBI published a joint security advisory.
October 2026: Conduent finalized an $80 million class-action settlement.
The Tech Race
The SafePay advisory mirrors the response trajectory seen during the 2024 Conduent attack, which culminated in an $80 million settlement. It highlights the growing challenge agencies face as attackers adopt double-extortion models that weaponize both data theft and operational downtime.
Security administrators managing infrastructure must audit edge devices and RMM software configurations to mitigate the lateral movement techniques identified by CISA. Organizations should prioritize securing VPN access and implementing strict credentials management to counter the methods used since August 2024.
The takeaway
The SafePay threat demonstrates that attackers are increasingly using revenue-based ransom models to maximize financial yield from infrastructure targets. Security teams should monitor future agency advisories for updated indicators of compromise associated with the group's PsExec and WinRM exploitation patterns.
Further reading
For broader trends in enterprise defense and digital threat intelligence, visit the Cybersecurity section.
Source note: This article includes information reported by Computer Crime Research Center.
Live Poll
Do you trust that major organizations are doing enough to protect critical infrastructure from ransomware?
