SafePay Ransomware Hits 600 Critical Orgs

CISA reports SafePay ransomware breached over 600 critical infrastructure organizations worldwide since August 2024. The group, active since 2024, targets North America, Europe, and Australia using VPN exploits and credential theft. Victims face double extortion tactics involving data theft and encryption. Since the start of 2025, SafePay has filled the gap left by BlackCat and LockBit operations.