SafePay ransomware group has targeted hundreds this year, US agencies say

The ​US Cybersecurity and Infrastructure ​Security Agency ‌said on ​Tuesday that about 600 victims were affected this year ‌by SafePay, one of the world's most active ransomware groups. Victims range from the Americas to ‌Australia, CISA said in a joint statement ‌with other agencies, including the Federal Bureau of Investigation and the US Secret Service.

SafePay gains network ⁠access ​by ⁠accessing compromised credentials and targets "known vulnerabilities" in internet-facing devices, the ⁠statement said. The group then steals data and ​encrypts systems, pressuring victims to pay by threatening ⁠to publish the stolen information. In some cases, ⁠according ​to the statement, the group calls victims directly.

"SafePay actors have already targeted more ⁠than 600 victims worldwide across multiple critical infrastructure ⁠sectors," ⁠said Brett Leatherman, the assistant director of the FBI's cyber division.