CISA and FBI Issue Joint Advisory on SafePay Ransomware After 600 Victims
This joint advisory from FBI, CISA, USSS and European law enforcement partners sets out the tactics, techniques and indicators of compromise used by SafePay ransomware actors, who have hit at least 600 victims across four continents. Security and incident response teams should use this to update detection rules and patch the specific CVEs named.
- SafePay threat actors have affected at least 600 separate victims across multiple critical infrastructure sectors since August 2024.
- The advisory names five CVEs exploited for initial access, including CVE-2024-40711 and CVE-2024-40766 affecting edge device products.
- SafePay uses a hybrid ChaCha20 stream cipher and RSA public-key encryption scheme, appending encrypted files with the .SafePay extension.
- Indicators of compromise listed were observed between November 2024 and August 2026, including IP addresses, malicious files and SHA-1 and SHA-256 hash values.
- Authoring agencies include the FBI, CISA, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, and two UK agencies, based on investigations as recently as August 2026.