CISA and FBI Issue Joint Cybersecurity Advisory on SafePay Ransomware Targeting Critical Infrastructure

The Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation published an urgent joint cybersecurity advisory on Wednesday, warning government agencies and private enterprise operators that the SafePay ransomware syndicate has compromised more than 600 critical infrastructure organizations worldwide since 2024. The detailed threat intelligence brief outlines tactical indicators of compromise, automated lateral movement scripts, and remediation guidance for utility providers, healthcare networks, and municipal emergency dispatchers.

Federal cyber investigators revealed that SafePay operators predominantly gain initial network access by weaponizing stolen remote-access credentials obtained through dark web credential markets or by exploiting known vulnerabilities in legacy enterprise virtual private network gateways. Once inside an organization's perimeter, the criminal actors execute bespoke PowerShell payloads and disable endpoint detection agents before deploying high-speed AES-256 encryption across virtualized datacenter clusters and storage backups.

San Francisco Bay Area cybersecurity executives and chief information security officers noted that SafePay has increasingly targeted municipal water agencies, regional hospital systems, and public transit operators across Northern California. The advisory urges systems administrators to immediately mandate phishing-resistant multi-factor authentication, segment operational technology networks from corporate intranets, and verify offline immutability for critical system restore snapshots.

CISA and the FBI emphasized that affected organizations should avoid paying extortion demands, which directly subsidize transnational cybercrime enterprises without guaranteeing decrypted data restoration. Systems administrators can download technical Yara detection rules, file hashes, and network defense checklists from the official federal advisory page at cisa.gov/news-events. Cyber incidents and suspected compromise indicators should be reported promptly to local FBI field offices or through cisa.gov/report.