As reported by SecurityAffairs, a joint advisory from CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies confirms that SafePay ransomware has compromised over 600 organizations since August 2024. What stands out isn't just the volume — it's how pedestrian the tradecraft is.
SafePay's success exposes a uncomfortable truth for the industry: the most devastating ransomware campaigns of the past two years don't require zero-days. They require defenders who haven't patched CVEs that are three to six years old.
Operational Profile: A Lean, Independent Operator
Unlike LockBit or BlackCat, which built franchise models with affiliates, SafePay operates as a tight, independent group. This matters strategically. Affiliate-driven operations fragment under law enforcement pressure — when one affiliate flips or infrastructure gets seized, cascading disruptions follow. Independent operators are more resilient because their OPSEC isn't shared across dozens of unrelated criminal teams with varying discipline levels.
SafePay's growth trajectory also correlates directly with the takedown of BlackCat (ALPHV) and the repeated disruptions of LockBit. When dominant platforms collapse, displaced affiliates and operators don't retire — they coalesce around whatever group demonstrates consistent payouts. SafePay filled that vacuum.
Entry Vector Analysis: Old CVEs, Stolen Credentials, and Mullvad VPN
SafePay's initial access techniques are textbook but effective:
| Technique | MITRE TTP | Details |
|---|---|---|
| Credential Exposure | T1552 | Phished or leaked credentials used for VPN/network access |
| Brute Force | T1110 | Automated password spraying against exposed services |
| VPN Exploitation | TA0001 | Known CVEs in Cisco, Veeam, and SonicWall edge products |
| Infrastructure Masking | — | Mullvad VPN IP addresses used to obfuscate source |
The advisory specifically notes SafePay actors use Mullvad VPN exit nodes for initial access. This is operationally significant. Mullvad is a legitimate privacy-focused VPN provider, and its IPs are shared among thousands of benign users. Defenders who block or alert on all Mullvad traffic will generate noise; instead, they need contextual alerting — Mullvad IPs authenticating to VPN concentrators, admin portals, or RDP gateways should trigger high-severity investigations, not blanket firewall blocks.
The exploitation of aging edge-device CVEs is the most indictment-worthy finding. Cisco VPN flaws from 2020 and 2023, a Veeam vulnerability, and a SonicWall access control issue are all well-documented, patched, and listed in CISA's Known Exploited Vulnerabilities Catalog. Organizations still running unpatched versions are essentially leaving the front door open with a sign that says "ransom me."
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Audit and patch all internet-facing edge devices — prioritize Cisco ASA/FTD, SonicWall SMA, and Veeam Backup & Replication. Cross-reference against the CISA KEV catalog for anything you've missed
- Enforce MFA on all VPN and remote access portals — if SafePay is using stolen credentials, a second factor breaks the attack chain at initial access
- Deploy contextual geolocation alerting — flag any Mullvad VPN IP range authenticating to external-facing infrastructure. Don't block; investigate the session
- Review credential exposure — check haveibeenpwned and dark web monitoring for your domain. Rotate any compromised credentials immediately
- Verify backup integrity and isolation — SafePay uses double extortion, meaning both encryption and data theft are in play. Offline, immutable backups are the only reliable recovery path
Strategic Hardening
- Reduce edge device attack surface — move VPN concentrators behind zero-trust access proxies where possible; restrict management interfaces to internal or jump-host access only
- Implement network segmentation — if SafePay gains initial access via VPN, lateral movement should hit a wall. Segment backup infrastructure, domain controllers, and critical OT systems
- Deploy EDR with ransomware-specific behavioral detection — look for mass file modification, shadow copy deletion (vssadmin), and credential dumping (LSASS access) as high-priority detections
- Establish an incident response retainer — 600 victims means the group is high-volume. If you're hit, you need forensics and negotiation support on contract within hours, not days
SafePay's trajectory suggests it will remain a top-tier threat through 2026. The group's reliance on known CVEs and credential access is both its weakness — every entry vector is preventable — and its strength, because enough organizations still haven't done the basics. The advisory is clear: the mitigations exist. The question is whether teams will implement them before SafePay finds their perimeter.
