FBI: SafePay ransomware gang hit over 600 victims since 2024

The FBI and cybersecurity agencies in Germany and the UK issued a joint advisory warning that the SafePay ransomware gang has breached at least 600 organizations across the U.S. and Europe since August 2024. SafePay is described as one of the most active ransomware groups in 2026, targeting businesses and critical infrastructure through password guessing, vulnerability exploitation and phishing.

• At least 600 organizations in the U.S. and Europe have been breached since August 2024
• The gang uses password guessing, flaws like CVE-2020-3259 and CVE-2024-40711, and phishing
• It relies on AnyDesk, TeamViewer and legitimate system tools to move through networks
• Ransom is demanded in cryptocurrency as a share of company revenue, with pressure calls