The methods of the SafePay group: how cybercriminals infiltrate networks

The SafePay Ransomware group exploits known vulnerabilities in internet-exposed devices, particularly through VPN services, to gain access to networks, as indicated by the CISA. Once inside, malicious actors use legitimate tools already present in systems to move laterally, disable or delete backups, and encrypt data. According to the joint advisory, they then threaten victims with publishing stolen information or contacting them directly to demand payment in cryptocurrency.

Initial access is often gained through compromised credentials or unpatched vulnerabilities, as highlighted by Chris Butera, executive assistant to the CISA: « Devices exposed with known vulnerabilities remain a prime target for groups like SafePay. » Critical sectors, as defined by U.S. authorities, are particularly affected, with concentrated activity in America, Europe, and Australia.

Devices exposed with known vulnerabilities remain a prime target for groups like SafePay, according to the CISA.

A global threat: 600 victims in two years, a record for a recent group

Since its emergence in August 2024, SafePay Ransomware has compromised around 600 organizations worldwide, an unusually high number for a group active for only two years, according to data from U.S. authorities and international partners such as Germany’s Landeskriminalamt or the UK’s National Crime Agency. This targeted campaign affects both private companies and critical infrastructure operators, as outlined in the #StopRansomware advisory published under number AA26-293A.

The methods used by SafePay include phishing, exploitation of software vulnerabilities, and the use of social engineering techniques to obtain initial access. Once the entry point is found, actors move through the network to locate sensitive data, encrypt it, and demand a ransom, while threatening to disclose the stolen information if the demand is not met.

What this means here: urgent recommendations for businesses and administrations in West Africa

For businesses and administrations in Benin and West Africa, this international alert underscores the importance of immediately strengthening defenses against ransomware. The recommendations from American and European authorities could apply locally: systematically update systems, require multi-factor authentication, maintain offline backups, and segment networks to limit the spread of an attack. The CISA and the FBI emphasize that these measures would significantly reduce the risks of intrusion and the impact of a SafePay attack.

Critical infrastructure in Benin, such as public services or telecommunications operators, could be particularly exposed if vulnerabilities in internet-connected devices are not addressed. VPN services, often used to secure remote access, are also becoming preferred attack vectors. Increased vigilance against phishing attempts and enhanced employee training in cybersecurity best practices would therefore be essential.

How to protect yourself: the recommended technical and organizational measures

The joint statement from CISA and the FBI provides indicators of compromise (IOCs) and recommended procedures to detect and counter SafePay activities. Among the priority actions are: urgently patching known vulnerabilities, conducting forensic triage to identify potential intrusions, and strictly applying the principle of least privilege to limit lateral movement by attackers.

Organizations are also encouraged to actively monitor suspicious connection attempts, to isolate critical systems, and to train IT teams on the latest ransomware tactics. Brett Leatherman, assistant director of the FBI’s cyber division, reminds us that « network defenders now have clear, actionable guidelines to protect their organizations against one of the most active ransomware groups of 2026. » These recommendations, while issued in an international context, can serve as a reference for local entities.