SvertokSearch

Security & FraudPublished:

U.S. and partner agencies warn SafePay ransomware has affected roughly 600 victims

SafePay operators use compromised credentials and vulnerable internet-facing devices to enter networks, steal data, disable backups and encrypt systems.

A malicious bundle is stopped by a network partition while separate data compartments remain isolated.

CISA, the FBI, the U.S. Secret Service and international partners released a joint SafePay ransomware advisory. The agencies described SafePay as one of 2026's most active ransomware groups and said it had affected approximately 600 victims across sectors in the Americas, Europe and Australia.

How SafePay gets leverage

According to the advisory, SafePay operators enter networks by compromising credentials and targeting known vulnerabilities in internet-facing devices. They often connect through virtual private network services, which normally give authorized users remote access to an organization's network.

Once inside, the operators use legitimate IT tools to move through the network. The agencies said they may delete or disable backups, steal data and encrypt systems before threatening to publish the stolen material. In some cases, the operators also call victims directly.

Encryption is only one part of the pressure. The theft supports threats to publish stolen information, while deleted or disabled backups undermine recovery.

What defenders should do now

CISA encouraged organizations to review the advisory and implement its mitigations.

The highlighted recommendations are:

  • Urgently patch the known exploited vulnerabilities identified in the advisory.
  • Conduct forensic triage, an initial investigation to determine whether systems have been compromised.

The victim count and geographic reach describe the campaign as a whole. They do not establish that any particular organization was compromised.

Next story

Man pleads guilty in fraud scheme targeting service members and veterans

A sealed geometric identity record is copied through a rust aperture into two account wells and a distant relay path.

Prosecutors said stolen personal information was used to access bank and benefits accounts, while money mules moved part of the proceeds.

Published October 21, 2026Source: U.S. Department of Justice

CISA urges immediate Ivanti Connect Secure updates after active exploitation

A rust ribbon passes through an open geometric gateway and remains faintly visible inside as a gold inspection beam crosses the structure beside a sage patch panel.

Attackers can run commands without authenticating, and Ivanti’s Integrity Checker Tool may miss evidence when those commands execute in memory.

Published October 17, 2026Source: CISA

CISA adds exploited Cisco SD-WAN Manager flaw to its priority catalog

A rust-colored route crosses the boundary of a layered navy network console and ends at a gold repair block.

Cisco says CVE-2026-76504 can let an unauthenticated remote attacker access Catalyst SD-WAN Manager as an administrator.