A joint advisory published this week warns that the SafePay ransomware operation has been linked to attacks on more than 600 organisations since 2024, making it one of the more prolific extortion groups currently in circulation. The advisory was reported by Security Affairs, which says it was co-published by CISA and five law-enforcement agencies: the FBI and the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and two UK bodies — three countries in total, with CISA signing on alongside as the US cyber-defence agency.
How SafePay gets in
As Security Affairs describes it, the group's playbook is unglamorous. Attackers begin with credentials — leaked, bought or harvested — and use them to authenticate to internet-facing VPN concentrators and other remote access services, avoiding the need to exploit software vulnerabilities at all. Once inside, the operators move laterally, escalate privileges and exfiltrate data before deploying encryption.
That sequence matters because it removes almost every dramatic element from the intrusion. There is no novel exploit chain to patch against, no supply-chain compromise to unwind. What SafePay depends on is a valid username and password, plus a remote access path that accepts them.
The extortion model compounds the pressure. Consistent with the double-extortion pattern now standard across the ransomware ecosystem, victims are told that refusal to pay will be followed by publication of the stolen material. Encryption becomes secondary to the reputational threat of a data leak.
Volume, not sophistication
The advisory describes SafePay as among the more active ransomware groups operating today, and the 600-plus figure points to an operation that prioritises throughput. The implication for defenders is straightforward: the group's effectiveness appears to track closely with credential hygiene and remote-access exposure rather than with any distinctive technical capability.
The advisory, as reported by Security Affairs, announces no disruption, arrest or takedown, and it does not publish a breakdown of the affected organisations by country or sector. Reporting on geographic spread should therefore be treated as unconfirmed until such a breakdown is released.
Mitigation priorities drawn from the advisory
Priorities highlighted in Security Affairs' account of the advisory's guidance include:
- Enforce phishing-resistant multi-factor authentication on all remote access, with a preference for FIDO-based or certificate-based methods over SMS or TOTP where feasible.
- Audit VPN and remote-access accounts, removing dormant credentials, shared accounts and any accounts lacking MFA, and reviewing authentication logs for anomalous sign-ins.
- Reduce the blast radius of a single credential, through network segmentation, tiered administration and least-privilege service accounts.
- Assume exfiltration is part of the playbook, which means tested offline backups and a rehearsed decision process for extortion demands.
- Monitor for the known indicators of compromise released alongside the advisory, and ingest them into detection tooling rather than filing them away as reference material.
None of these steps is novel. That is precisely the point: SafePay's reported success rests on the persistence of fundamentals that defenders have been urging for years.
Why it matters beyond the advisory's signatories
The coalition spans North America and Europe, but the technique set — stolen credentials, VPN entry, double extortion — is jurisdiction-agnostic, and organisations in any region with internet-facing remote access are within reach of the same playbook. For security teams anywhere with internet-facing remote access, the advisory offers a useful benchmark: it is a reminder that the most consequential control failures are frequently the least exotic ones, and that credential hygiene remains the cheapest gap to close.
The advisory was reported by Security Affairs; readers should consult the primary joint advisory for the full indicator list and recommended detection logic.
本周發布的聯合警告指，SafePay 勒索軟件行動自2024年起已牽涉對超過600個組織的攻擊，成為現時流通中最活躍的勒索集團之一。據率先報道該警告的 Security Affairs 指出，文件由 CISA 與五個執法機構共同發布：美國聯邦調查局（FBI）及美國特勤局、德國萊茵蘭-普法爾茨州刑事警察局（Landeskriminalamt Rheinland-Pfalz），以及英國兩個機構——合共三個國家，CISA 則以美國網絡防禦機構身份聯合署名。
SafePay 如何入侵
據 Security Affairs 描述，該集團的作案手法平淡無奇。攻擊者首先取得認證資料——不論是外洩、購買還是自行搜集——然後用來驗證身份，登入面向互聯網的 VPN 集中器及其他遠端存取服務，完全毋須利用軟件漏洞。一旦進入網絡，作案者便橫向移動、提升權限、竊取數據，最後才部署加密程序。
這個次序之所以重要，是因為它幾乎移除了入侵事件中所有戲劇性的元素：沒有需要修補的新型 exploit chain，也沒有需要拆解的供應鏈入侵。SafePay 所依賴的，只是一個有效的用戶名稱和密碼，加上一條接受該組認證資料的遠端存取路徑。
勒索模式令壓力進一步加劇。與現時勒索軟件生態系統普遍採用的雙重勒索模式一致，受害者會被告知：拒絕付款，被盜資料將隨之公開。相對於數據外洩帶來的聲譽威脅，加密反而變成次要。
靠量取勝，並非技術高超
警告文件形容 SafePay 是現時最活躍的勒索軟件集團之一，超過600個組織的數字顯示該行動優先追求作案量。對防禦者的啟示相當直接：該集團的成效似乎與認證資料管理及遠端存取暴露程度密切相關，而非倚賴任何獨特的技術能力。
據 Security Affairs 報道，警告文件並未宣布任何搗破或拘捕行動，也未有宣布終止該集團運作，同時沒有按國家或行業列出受影響組織的分佈。因此，有關攻擊地理分佈的報導，在相關分佈數據公布前應視為未經證實。
從警告文件歸納的緩解措施優先事項
Security Affairs 就警告文件指引所整理的優先事項包括：
- 強制實施具防釣魚能力的多重身份驗證（multi-factor authentication）於所有遠端存取，在可行情況下，優先採用基於 FIDO 或 digital certificate 的方式，而非 SMS 或 TOTP。
- 審核 VPN 及遠端存取帳戶，移除閒置認證資料、共用帳戶以及任何未設 MFA 的帳戶，並檢視驗證日誌中的異常登入記錄。
- 縮減單一認證資料被濫用的影響範圍，透過網絡分段（network segmentation）、分層管理及最小權限服務帳戶（least-privilege service accounts）達成。
- 假設數據外洩已屬作案手法的一部分，亦即須備有經測試的離線備份，以及一套已演練的勒索要求應對決策流程。
- 監察警告文件同時發布的已知 indicator of compromise，並將其納入偵測工具，而非僅作參考資料存檔。
以上每一步都並非新意。這正正是重點所在：SafePay 報道中的成功，建基於防禦者多年來一直敦促落實的基本功仍未被貫徹執行。
為何事態影響超越警告文件的簽署機構
該聯盟涵蓋北美與歐洲，但所涉技術手段——被竊認證資料、VPN 入侵、雙重勒索——並不局限於特定司法管轄區，任何擁有面向互聯網遠端存取的地區，其組織都在同一套手法的攻擊範圍之內。對於任何擁有面向互聯網遠端存取的資訊保安團隊而言，警告文件提供了一個有用的基準：它提醒我們，後果最嚴重的防禦失效往往並非最複雜的那些，而認證資料管理仍然是成本最低、最易於彌補的漏洞。
警告文件由 Security Affairs 報導；讀者應查閱原始聯合警告文件，以獲取完整的 indicator 清單及建議偵測邏輯。