CISA Alerts Organizations to Active SafePay Ransomware Threat

CISA has issued an advisory on the SafePay ransomware group, identified as highly active in 2026, having compromised around 600 critical infrastructure organizations globally. The group gains access via compromised credentials and exploiting known vulnerabilities in internet-facing devices. CISA urges organizations to implement mitigations, including immediate patching of exploited flaws, to protect against this widespread threat.