As reported by BleepingComputer, CISA and FBI have confirmed that the SafePay ransomware operation has compromised more than 600 critical infrastructure organizations across North America, South America, Europe, and Australia since August 2024. This is a significant scale of impact for a group that only emerged two years ago — and it reveals persistent, systemic weaknesses in how critical infrastructure sectors secure perimeter access.
What stands out in the joint advisory is not novelty but consistency. SafePay isn't using zero-days or bespoke tooling. They're succeeding with credential exposure, brute-force attacks, exploitation of edge device CVEs through automated scripts, and abuse of VPN infrastructure — specifically Mullvad VPN exit nodes. These are the same initial access vectors that have plagued defenders for years. The fact that 600+ organizations across multiple continents fell to these methods tells us the gap isn't in threat intelligence; it's in basic hygiene execution.
Why This Matters
Critical infrastructure operators are held to a different standard — availability and uptime are non-negotiable, and regulatory scrutiny under frameworks like CIRCIA, NIS2, and Australia's SOCI Act is intensifying. Six hundred confirmed victims across multiple sectors means SafePay has likely encountered and adapted to a wide variety of network architectures, making their playbooks increasingly efficient. Their anti-recovery actions — deleting shadow copies and resetting NAS backup appliances — are particularly destructive because they eliminate the fastest path to restoration, forcing organizations into a position where paying appears to be the only viable option.
SafePay's private operation model (no affiliates) also means tighter operational security and a more predictable evolution curve compared to RaaS groups where tooling leaks are common. This makes defensive detection harder because there are fewer external exposure points for researchers to observe.
Who Is at Greatest Risk
Shield53 Recommendations
Defenders should move immediately on three layers:
1. Edge Exposure Reduction
Audit every internet-facing VPN, firewall, and remote access appliance against the current CISA KEV catalog. If a CVE applies and a patch exists, apply it within 72 hours — not the next maintenance window. Disable unused remote access services entirely rather than leaving them dormant but reachable. If using Mullvad or any commercial VPN, ensure outbound traffic from these IPs is logged and scrutinized for anomalous authentication patterns.
2. Credential and Identity Hardening
Enforce phishing-resistant MFA (FIDO2/WebAuthn, not SMS or push) on all VPN and remote access entry points. Implement account lockout thresholds to defeat brute-force campaigns. Audit service accounts and shared credentials — SafePay's use of phished profiles suggests they're pivoting from low-privilege to high-privilege through credential reuse.
3. Backup Resilience
SafePay actively destroys recovery options by deleting shadow copies and resetting NAS devices. Implement immutable, offline, or air-gapped backups that cannot be modified or deleted through administrative credentials of the production domain. Test restoration quarterly — not annually. Segregate backup management networks so compromise of the production domain doesn't grant access to backup infrastructure.
SafePay's playbook proves that for critical infrastructure, the gap between adequate and compromised isn't about having the right tools — it's about executing fundamentals consistently across every edge.
Network defenders should also ingest the IOCs and TTPs from the joint advisory into their SIEM and EDR platforms, and hunt for the described behaviors — particularly credential brute-force attempts against VPN endpoints and mass file deletion activity characteristic of shadow copy destruction. Given SafePay's sustained activity over two years, waiting for the next advisory is not a viable strategy.
