The Record reports:
At least 600 organizations across the U.S. and Europe have been breached by the SafePay ransomware gang since August 2024, according to a new advisory from international law enforcement agencies.
The FBI and cybersecurity agencies in Germany as well as the U.K. said SafePay is now “among the most active ransomware groups in 2026” and is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
The advisory was created based on numerous FBI and German law enforcement investigations involving SafePay, with the most recent incident occurring in August.
The advisory lists multiple vulnerabilities the group has used in attacks, including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766 and others.
“Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones,” the agencies said.
Read more at The Record.
