SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns

SafePay has emerged as a dominant ransomware threat since August 2024, targeting critical infrastructure across four continents. With at least 600 organizations compromised, the group is characterized by high activity levels in 2026 and a sophisticated technical repertoire. Their operations involve diverse initial access vectors, "living off the land" techniques for lateral movement, and a hybrid encryption scheme. The group employs a double extortion model, leveraging both data leaks and direct telephonic pressure to compel cryptocurrency payments.
There is significant uncertainty regarding the group's origin, as evidence suggests SafePay may be a strategic rebranding of existing entities like LockBit, ALPHV/BlackCat, or INC Ransomware. The real-world impact is exemplified by the November 2024 attack on Conduent, which led to massive data exfiltration and a subsequent $80 million legal settlement. To mitigate these threats, security frameworks emphasize a combination of vulnerability remediation, strict identity management through MFA, and the maintenance of immutable, offline backups.

SafePay is a ransomware group that emerged in August 2024.
At least 600 critical infrastructure organizations have been compromised.
Operations affect North America, South America, Europe, and Australia.
The group was the third most active ransomware actor in the first four months of 2026.
SafePay claimed 70 attacks in May 2026.
SafePay is suspected to be a rebrand of LockBit, ALPHV/BlackCat, and INC Ransomware.
Conduent, a US business services firm, was attacked in November 2024.
Conduent paid $80 million to settle a class action lawsuit on October 16, 2026.
Initial access vectors include credential exposure, brute force attacks, VPN exploitation, and edge device vulnerabilities.
Exfiltration tools used include FileZilla, OneDrive, 7-Zip, RClone, and WinRAR.
Encryption uses a hybrid scheme combining ChaCha20 and RSA.
Extortion involves a TOR chat portal, cryptocurrency demands based on revenue, and phone calls to victims.

The narrative presents a textbook case of the "Hydra Effect" in cybercrime: the rebranding of defunct or sanctioned groups into new identities to evade attribution while retaining the same operational infrastructure. By framing SafePay as a standalone entity while simultaneously linking it to LockBit and ALPHV, the narrative illustrates the fluidity of the ransomware ecosystem.
The strongest version of this narrative is a necessary public safety warning. It provides actionable TTPs and clear remediation steps to protect critical infrastructure. However, the reliance on vendor-provided metrics (BlacKite and NCC Group) to establish the group's "rank" suggests a drive toward quantification that may prioritize visibility over nuanced threat intelligence.
The root cause is the professionalization of cyber-extortion. SafePay is not merely "hacking"; they are operating a business model that includes a sales funnel (the TOR portal) and a collections department (the phone calls). This shifts the paradigm from technical failure to psychological warfare. The implication is a steady erosion of organizational agency, where the cost of "doing business" now includes multi-million dollar legal settlements and cryptocurrency ransoms.
Patterns detected: none
Counterstrike Scan: A coordinated influence campaign would use these facts to manufacture a state of "cyber-panic" to drive the adoption of specific security software. The current content remains a neutral advisory and does not match that pattern.
Bridge Questions:
1. How does the "rebranding" of ransomware groups affect the ability of international law enforcement to conduct successful attribution?
2. If payment settlements (like Conduent's) become the standard outcome of these attacks, does this inadvertently incentivize more aggressive targeting of business services firms?
3. Which gaps in "critical infrastructure" definitions allow 600 organizations to be compromised before a joint international advisory is issued?