CISA and partner agencies issue a SafePay ransomware advisory, urging isolated backups and restrictions on administration tools
CISA, FBI, USSS and international partners jointly published information on SafePay activity, saying attackers steal data, encrypt systems and may damage backups. They recommend prioritising edge-device patches, stronger account authentication and restrictions on administration tools.
Source Facts
On 20 October, CISA published a joint advisory summary covering SafePay's known behaviours, indicators of compromise, response and mitigations. It identifies entry routes including leaked credentials, password guessing, phishing and vulnerabilities in internet-facing systems.
The advisory notes that this activity may delete shadow copies or reset network storage holding backups, obstructing recovery. Recommendations include prompt patching of VPNs, firewalls and similar devices, MFA and restricting administration tools to essential personnel.
If backup copies share administration privileges with production systems, recovery options face the same risks. Include isolation and restoration verification in exercises.
Original sources
CISA, FBI and Partners Release Joint Cybersecurity Advisory on SafePay Ransomware
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
IllustrationLiteLLM explains package compromise: exposed keys must be revoked to complete the response
Illustration