CISA warns of global SafePay ransomware attacks on critical infrastructure

CISA issued an advisory on October 20, 2026, regarding the SafePay ransomware group's attacks on critical infrastructure across four continents ^[1].

The group's activity targets the integrity of business and infrastructure networks by compromising identities and exploiting known software flaws. The agency is urging organizations to implement security measures to reduce the risk and impact of these attacks ^[1].

Global scope of SafePay activity

SafePay ransomware actors have been highly active since August 2024 ^[1]. The group's campaign spans North America, South America, Europe, and Australia, specifically targeting businesses and critical infrastructure ^[1].

The widespread nature of the campaign suggests a broad target set across different regulatory environments. CISA's advisory warns that organizations in these regions are at risk if they fail to apply recommended security patches and updates ^[1].

Initial breach and network infiltration

The group typically gains network access through three primary methods: stealing or guessing passwords, exploiting security system vulnerabilities, and using phishing tactics ^[1]. These methods allow the actors to bypass perimeter defenses and enter the internal environment.

Once inside the network, SafePay actors establish persistent control ^[1]. They do this by either hijacking existing user accounts or creating entirely new accounts to maintain access ^[1].

Internal movement and encryption

After securing a foothold, the group uses legitimate system tools to navigate the network ^[1]. This technique, known as lateral movement, allows attackers to identify valuable files and disable security protections while avoiding detection by security software ^[1].

The final phase of the attack involves the encryption of the victim's files, which renders them inaccessible ^[1]. The group then leaves a ransom note demanding payment in cryptocurrency to restore the data ^[1].

Technical vulnerabilities exploited by SafePay

CISA identified several specific vulnerabilities that the SafePay group exploits to facilitate its attacks ^[1]. These include CVE-2020-3259, which relates to the exposure of sensitive information to unauthorized actors ^[1].

The group also leverages authentication and access control flaws, including CVE-2023-20269 and CVE-2023-27532 ^[1]. Other affected vulnerabilities listed in the advisory are CVE-2024-40711, involving the deserialization of untrusted data, and CVE-2024-40766, which concerns improper access control ^[1].

What we don't know

• Which specific industries within the critical infrastructure sector are the primary targets of SafePay?
• How many organizations have been confirmed as victims of the group since August 2024?
• Which specific software products are associated with the five listed CVEs?