The SafePay ransomware operation has compromised more than 600 critical infrastructure organisations worldwide since 2024, according to a joint advisory from the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, as reported by BleepingComputer.
What the agencies are asking for is less a technical indictment of the group's tradecraft than a push on the fundamentals: phishing-resistant multi-factor authentication, tighter controls on remote access, and the working assumption that any exposed management interface will eventually be found.
What the agencies are asking for
The recommendations themselves are familiar; their framing is what stands out. CISA and the FBI are pressing organisations toward MFA that cannot be defeated by phishing or relay attacks — not SMS codes, and not push approvals that users can be talked into rubber-stamping — alongside limits on who can reach remote access tooling from the open internet.
Behind that sits the conventional hygiene checklist: offline or immutable backups that ransomware cannot reach, patching of internet-facing systems, network segmentation, and monitoring for abuse of legitimate administrative tooling. Defenders are being told to treat the presence of living-off-the-land activity as a signal in itself, rather than waiting for a ransom note.
Reports of SafePay's methods — purging volume shadow copies, enumerating directory services, interfering with endpoint security software — match prior reporting on the group, though the agencies' headline emphasis remains squarely on access hygiene rather than on novel technique.
Why 600 matters
Six hundred victims is not a record in ransomware terms, but the composition of the list is what draws attention. These are critical infrastructure organisations — the category of target where downtime propagates beyond the victim.
Two readings follow. The first is that this is an industrialised operation: a volume business that treats intrusion as a supply-chain problem rather than a bespoke one, hitting targets opportunistically wherever weak access control leaves a door open. The second is the uncomfortable one for the defence community — an operation leaning on widely available, comparatively unsophisticated tradecraft has still accumulated hundreds of critical-infrastructure victims. Novel attackers are not needed when basic access hygiene remains inconsistent.
The joint, cross-border framing of the advisory also signals how the agencies see the threat: as a transnational campaign that individual defenders cannot sit out. Notably, neither agency's public materials attribute the operation to a specific country or disclose whether payments have been made — an important caveat for anyone tempted to read more into the announcement than it says.
The practical checklist
For defenders, the convergence of advice is straightforward:
- Phishing-resistant MFA on all remote access, administrative consoles, and email.
- Offline or immutable backups, tested for restoration, kept separate from production credentials.
- Perimeter patching, with special attention to VPN appliances, remote desktop gateways, and other internet-facing management surfaces.
- Detection of living-off-the-land activity, including legitimate tooling abused for lateral movement and shadow-copy deletion.
None of these measures are new. That, arguably, is the point: an operation of this scale has been assembled against the defences organisations already know they should have in place.
Relevance for Hong Kong practitioners
For readers in Hong Kong, the story functions as an international reference point rather than a local regulatory development. Double-extortion ransomware — where data is exfiltrated before encryption and published if payment stalls — means a successful intrusion carries consequences beyond operational downtime: any exposure of personal data brings data-protection obligations into play under the Personal Data (Privacy) Ordinance, and organisations are well advised to review their breach-handling and notification procedures accordingly. The Privacy Commissioner for Personal Data's published materials on ransomware and data security remain the appropriate local reference for those procedures.
The lesson travels regardless of jurisdiction: the attacks described in the advisory succeed through gaps in access control, not through exotic vulnerabilities.
Source: BleepingComputer
據 BleepingComputer 報道，美國網絡安全和基礎設施安全局（CISA）與 FBI 聯合發布警告指，SafePay 勒索軟件行動自 2024 年以來已入侵全球超過 600 間關鍵基礎設施機構。
兩機構所要求的，與其說是對該組織技術手法的專業指摘，不如說是對基本功的敦促：採用抗釣魚的 multi-factor authentication（MFA）、加強遠程訪問管控，以及抱定一個工作前提——任何暴露的管理界面終有一天會被發現。
兩機構的要求
建議本身並不新鮮；令人注目的是其表述方式。CISA 與 FBI 正敦促機構採用無法被釣魚或 relay 攻擊擊破的 MFA——不是 SMS 驗證碼，也不是用戶容易被游說盲簽的 push 批准——同時限制誰可以從公開互聯網接觸遠程訪問工具。
背後是一份傳統的防護清單：勒索軟件無法觸及的離線或不可變備份（immutable backup）、對外系統的 patching、網絡分段（network segmentation），以及監控合法管理工具是否被濫用。防禦者被告知，應將 living-off-the-land 活動的出現本身視為一個信號，而非坐等勒索紙條出現。
關於 SafePay 手法的報告——清除 volume shadow copies、枚舉 directory services、干預 endpoint security 軟件——與過往對該組織的報道大致吻合，惟兩機構的重點強調仍集中在訪問衛生（access hygiene），而非新穎技術。
為何 600 這個數字重要
以勒索軟件而言，600 間受害機構並非紀錄，但名單的構成才是焦點所在。這些是關鍵基礎設施機構——屬於停擺影響會超越受害機構本身的目標類別。
由此有兩種解讀。其一，這是工業化的運作：一門規模化生意，將入侵視為供應鏈問題而非度身訂造的個案，伺機在任何防護薄弱、門戶大開之處出手。其二，對防禦界而言較為難堪——一個依靠廣泛可得、相對不複雜手法的行動，仍累積了數百間關鍵基礎設施受害者。當基本的訪問衛生仍不一致時，根本不需要新奇攻擊者。
警告的跨國聯合框架亦顯示兩機構如何理解此威脅：這是一場個別防禦者不能坐視其過去的跨國運動。值得注意的是，兩機構的公開材料均未將該行動歸因於特定國家，亦未披露贖金是否已支付——任何試圖從公告中讀取更多含義者，須留意此重要保留。
實務清單
對防禦者而言，各方建議的匯總相當直接：
- 所有遠程訪問、管理控制台及電郵一律啟用 抗釣魚 MFA。
- 離線或不可變備份，經還原測試，並與生產環境憑證分開保存。
- 邊界 patching，特別留意 VPN 裝置、remote desktop gateway 及其他對外管理界面。
- 偵測 living-off-the-land 活動，包括被濫用於 lateral movement 及刪除 shadow copy 的合法工具。
以上措施沒有一項是新的。這正是重點所在：如此規模的行動，竟是針對機構早已明知應該具備的防禦而建立的。
對香港從業者的啟示
對香港讀者而言，此報導的意義在於提供國際參照，而非本地監管發展。雙重勒索（double extortion）式勒索軟件——在加密前先竊取資料，若未付款則公開——意味著成功入侵的後果不限於運作停擺：任何個人資料外洩均會觸發《個人資料（私隱）條例》下的資料保護責任，機構應相應檢討其資料洩露處理及通報程序。個人資料私隱專員公署就勒索軟件及數據安全發表的材料，仍是此類程序適當的本地參考。
此教訓不論司法管轄區皆然：警告中所述的攻擊之所以得逞，是源於訪問控制的漏洞，而非 exotic 漏洞。
來源：BleepingComputer