Cyber Security· Important
CISA and partners warn of active SafePay ransomware campaign exploiting edge-device flaws
A joint advisory from the FBI, CISA, USSS and European law-enforcement agencies details the SafePay ransomware group, active since August 2024 and responsible for at least 600 attacks across North America, South America, Europe and Australia. SafePay gains access via stolen/brute-forced credentials, phishing, and exploitation of known VPN and edge-device vulnerabilities, then uses legitimate admin tools to move laterally, disable defenses, exfiltrate data and encrypt files with a ChaCha20/RSA hybrid scheme before demanding ransom.