IC Technology & Cyber — 2026-10-21

CISA and FBI Issue Joint Advisory on SafePay Ransomware Targeting Critical Infrastructure

BLUFSafePay will very likely claim a new US critical infrastructure victim within the next 30 days, as the advisory's publication will not materially reduce the group's access to unpatched edge devices faster than it can exploit them.

CISA and the FBI, with the US Secret Service and German and UK law enforcement partners, published a joint advisory on October 20 stating that SafePay has affected at least 600 victims across multiple critical infrastructure sectors since August 2024 12. The advisory lists initial access through stolen or guessed credentials, phishing, and exploitation of five named CVEs, including CVE-2024-40766, in edge and internet-exposed systems 1. It also describes data exfiltration before encryption, a ransom demand set as a subset of company revenue in cryptocurrency, and phone calls to victims on the group's behalf 13. The Record reported that SafePay has claimed attacks on Microlise and Conduent, and that Conduent announced an $80 million class action settlement last Friday 3.

Analysis
High confidence rests on a primary government advisory documenting at least 600 victims since August 2024, an operating leak site, and activity continuing through August. The Record and other outlets reproduce its figures without contradiction, though they add little independent collection. Naming CVE-2024-40766 and four other edge-device flaws indicates unpatched firewalls and VPN appliances remain the main entry point, and publication will not close that exposure quickly. SafePay will very likely claim or be reported to have claimed a new US critical infrastructure victim between October 21 and November 20, 2026. Defenders face extortion pressure beyond encryption, since SafePay exfiltrates first, sets demands against revenue, and phones victims. Conduent's $80 million settlement shows the liability that follows a contractor breach. The advisory may instead reflect an agency push to publicize a group whose pace is already declining, and law enforcement attention could disrupt or rebrand it. Operators and contractors should prioritize patching the five CVEs and rehearse extortion response now.

4 sources

#StopRansomware: SafePay Ransomware - CISA
SafePay ransomware group has targeted hundreds this year, US agencies say - WKZO (Reuters)
FBI says SafePay ransomware gang 'among most active' with more than 600 victims since 2024 - The Record (Recorded Future News)
SafePay Ransomware Group Warning from Feds - ISSSource