SafePay routed 600 ransomware hits through Mullvad

CISA, the FBI, the U.S. Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and the UK’s National Crime Agency and North West Regional Organised Crime Unit have published a joint advisory on SafePay, a ransomware group that has hit at least 600 critical infrastructure organizations across North America, South America, Europe, and Australia since August 2024. The 600 figure spans multiple sectors and undercounts the real total: SafePay only names victims who refuse to pay on its dark web leak site, so the number of organizations actually breached and extorted is higher.

SafePay appeared in August 2024 as a private operation that runs without affiliates, which is what makes the volume worth paying attention to. Most groups that rack up hundreds of victims do it by recruiting affiliates and splitting the proceeds. SafePay did it in-house, and since the start of 2025 it has absorbed much of the activity that BlackCat (ALPHV) and LockBit used to own, moving into one of the top active slots.

How they get in

Initial access comes from the usual places, with one detail the agencies flag specifically. SafePay actors use exposed credentials, brute force against passwords, and VPN access. The advisory calls out that they route through IP addresses belonging to the commercial VPN provider Mullvad. They also work with phished account profiles and run automated scripts that exploit known CVEs in edge devices and other internet-exposed systems.

That last point is the practical one. Edge devices are the recurring entry vector, and the agencies direct defenders to CISA’s Known Exploited Vulnerabilities catalog, with emphasis on flaws in VPNs, firewalls, and similar appliances. These are the systems SafePay’s automated scripts exploit, and the ones that tend to lag on patching.

Once inside, the group behaves like a competent intruder planning for extortion. It steals documents before encrypting anything, the standard double-extortion play, and threatens to publish the stolen data if the ransom goes unpaid. It also targets your ability to recover: the advisory describes SafePay deleting shadow copies and resetting network-attached storage devices that hold backups. If your recovery plan assumes local snapshots or an on-network NAS will survive the incident, this group is built to defeat exactly that assumption.

What to do about it

The mitigations in the advisory are specific and follow directly from the access pattern. Restrict administrative tools and privileges so that a single compromised account cannot move laterally through the environment. Put MFA on everything, and implement identity, credential, and access management (ICAM) policies rather than leaving account security to passwords alone. Given the Mullvad detail, review whether your VPN and remote access endpoints should be accepting connections from commercial VPN exit ranges at all.

Keep edge devices patched, and treat anything in the KEV catalog affecting VPNs and firewalls as urgent rather than routine. Those are the appliances SafePay is actively exploiting for initial access.

For backups, the shadow copy deletion and NAS reset behavior means on-network, online backups are not a recovery plan against this actor. Backups need to be offline or otherwise isolated from the credentials and network paths an intruder would have after compromise, and the restore process needs to be tested against the assumption that everything reachable from a domain admin account is gone.

The agencies also repeat the line that gets ignored every time: paying the ransom does not guarantee you get your files back. They urge victims to report incidents to law enforcement.

The advisory carries indicators of compromise and TTPs drawn from FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations into SafePay activity observed between November 2024 and August 2026. If you run critical infrastructure in any of the affected regions, that IOC and TTP set is the part to pull into detection tooling now.