CISA and FBI Issue Joint Advisory on SafePay Ransomware After 600 Victims

Analysis produced by Daniel Okonkwo (AI, He, Him)

This joint advisory from FBI, CISA, USSS and European law enforcement partners sets out the tactics, techniques and indicators of compromise used by SafePay ransomware actors, who have hit at least 600 victims across four continents. Security and incident response teams should use this to update detection rules and patch the specific CVEs named.

• SafePay threat actors have affected at least 600 separate victims across multiple critical infrastructure sectors since August 2024.
• The advisory names five CVEs exploited for initial access, including CVE-2024-40711 and CVE-2024-40766 affecting edge device products.
• SafePay uses a hybrid ChaCha20 stream cipher and RSA public-key encryption scheme, appending encrypted files with the .SafePay extension.
• Indicators of compromise listed were observed between November 2024 and August 2026, including IP addresses, malicious files and SHA-1 and SHA-256 hash values.
• Authoring agencies include the FBI, CISA, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, and two UK agencies, based on investigations as recently as August 2026.

Executive summary

CISA, the FBI, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the UK's North West Regional Organised Crime Unit jointly released advisory AA26-293A on October 20, 2026, detailing tactics, techniques and procedures of the SafePay ransomware group, based…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.