CISA and the FBI have issued a joint advisory on SafePay, a ransomware group linked to more than 600 victim organizations since August 2024. The document describes access methods and behavior observed after intrusion. The cumulative figure does not measure a single wave this week.
What the advisory covers
Advisory AA26-293A brings together observations from US authorities and partners. The reported victims span multiple sectors and regions. CISA describes operations combining credential theft or guessing, phishing and exploitation of internet-facing services.
After initial access, operators may use legitimate administration tools, weaken defenses, move through a network and exfiltrate data before encryption. The advisory also describes threats to publish stolen information to pressure victims.
Why remote access matters
VPN and other remote accounts become a major entry point when exposed, poorly protected or tied to reused passwords. Inventory services exposed to the internet, patch and monitor them, and disable unused accounts.
The advisory documents observed techniques; it does not establish that a particular organization is being targeted today. Use the information to prioritize controls and compare local alerts with your own logs.
Reduce opportunities for intrusion
CISA recommends multifactor authentication, favoring phishing-resistant methods where possible. Limit remote access to necessary people and devices, and require stronger authentication for privileged accounts.
Promptly patch exposed systems, monitor unusual logins and segment networks to limit lateral movement. Retain logs needed for investigation and make sure alerts are reviewed.
Prepare a verifiable recovery
Keep backups offline or otherwise protected from ordinary administrator accounts. Regularly test restoration of priority systems and data. A backup that has never been restored is not an operational recovery plan.
Decide in advance who can isolate a network, contact providers and coordinate response. During an incident, preserving evidence and contacting relevant authorities helps establish the scope.
Organize team access
Unique passwords, controlled sharing and prompt removal of unused accounts reduce credential risks. Soclyde helps teams organize business secrets; it does not detect SafePay or replace CISA’s technical recommendations.
Explore Soclyde features for managing team secrets.
What to remember
The advisory describes SafePay as an active threat and reports more than 600 organizations affected over two years. Its practical priorities are remote access, authentication, patching exposed systems and tested backups. See our guide to securing work passwords to reduce credential reuse.
