SafePay ransomware campaign compromises over 600 critical‑infrastructure organizations worldwide

What happened

SafePay ransomware has infiltrated over 600 critical‑infrastructure organizations by exploiting exposed VPN credentials, brute‑force attacks, and known CVEs in edge devices. After gaining foothold, the group encrypts data, steals documents, and often deletes shadow copies to hinder recovery.

Why it matters for trust and compliance

• The campaign illustrates why continuous monitoring of MFA enforcement, privileged‑access restrictions, and immutable backup evidence are essential for a defensible control‑assurance posture.
• Validate MFA and least‑privilege policies with real‑time evidence to satisfy identity‑access control objectives.
• Document patch‑management and backup‑integrity controls to demonstrate resilience against ransomware.

Who is affected

Recommended actions

1. Enforce MFA and strict ICAM policies for all remote‑access accounts.
2. Patch all VPN and edge‑device firmware to mitigate known CVEs.
3. Implement immutable, offline backups and verify shadow‑copy protection.
4. Run a ransomware tabletop exercise and capture control evidence for audit readiness.