CISA, the FBI and the UK's National Crime Agency have confirmed that SafePay ransomware has breached over 600 critical infrastructure organisations worldwide since August 2024. For UK operators, the joint advisory is less a warning than a checklist — and a hard look at whether robust backup and disaster recovery plans would actually survive contact with this group.
View the data behind this chart
| Phase | Starts (week) | Duration (weeks) |
|---|---|---|
| Emergence as private group | 0 | 40 |
| Fills LockBit/BlackCat gap | 40 | 34 |
| 600+ orgs confirmed breached | 74 | 30 |
| Joint CISA/FBI/NCA advisory | 104 | 10 |
A joint advisory with direct UK authorship
This isn't a US-only alert. The report naming SafePay as one of the most active ransomware operations globally was co-authored by CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, and — notably — the UK's National Crime Agency and North West Regional Organised Crime Unit.
That UK law enforcement involvement signals SafePay activity against British organisations has been significant enough to warrant formal participation in the advisory, not a passing mention. For infrastructure buyers, that's a reason to treat this as operational intelligence rather than background noise.
How SafePay gets in — and why password hygiene still matters
CISA's technical detail is specific: SafePay actors gain initial access through credential exposure, brute-force password attacks, and VPN exploitation — with particular attention paid to IP addresses linked to the Mullvad VPN provider. They also use phished account credentials and automated scripts that scan for known CVEs on internet-facing edge devices such as VPNs and firewalls.
Unlike LockBit or BlackCat-era operations, SafePay runs as a private group without affiliates, which may explain its methodical, repeatable approach to brute-forcing and credential abuse rather than relying on a sprawling affiliate ecosystem.
For UK data centre and infrastructure operators, this reinforces a basic but frequently skipped discipline: every internet-exposed edge device needs to be patched against CISA's actively exploited vulnerabilities catalogue, and MFA plus identity and access management controls need to be non-negotiable across VPN and remote access points. Building — or revisiting — ransomware protection strategies around these specific entry vectors is the most direct response available right now.
Backups are the target, not just the insurance policy
CISA's advisory makes a point that should reshape backup architecture decisions: SafePay actors actively disrupt recovery by deleting shadow copies and resetting network-attached storage devices that contain backups. This is a deliberate, documented tactic, not an incidental side effect of encryption.
That single detail is the strongest argument for isolating backups from the production network and identity domain they protect. If your NAS-based backup can be reset by an attacker who already has domain credentials, it was never truly a recovery option — it was just another asset waiting to be destroyed alongside the primary estate.
This is also where Microsoft 365 data deserves specific scrutiny. Native retention and recycle-bin mechanisms in M365 are not a substitute for an isolated, immutable backup copy. Organisations that haven't separately assessed this risk should review why Microsoft 365 backup is essential and then compare Microsoft 365 backup solutions that hold copies outside the tenant's own identity and administrative boundary.
Double extortion and the 37% problem
SafePay follows a double-extortion model — stealing sensitive data before encrypting systems, then threatening publication if a ransom isn't paid. CISA's advisory adds that paying a ransom does not guarantee file recovery, which undercuts the usual fallback argument for treating ransom payment as a pragmatic shortcut.
A separate data point sharpens the urgency: once attackers are operating with valid credentials inside a network, only 37% of their subsequent actions get blocked, according to Blue Report 2026 analysis of 338 million simulations in production environments. In other words, prevention at the perimeter matters, but it is not where the real battle is decided once an intrusion succeeds.
That statistic is a strong case for investing in post-compromise detection rather than relying solely on prevention scores. Teams should pressure-test their managed detection & response capability against lateral movement scenarios specifically, since SafePay is documented as restricting admin tools and exploiting internal trust relationships once inside.
What UK critical infrastructure and data centre operators should do now
The advisory's own recommendations give a practical starting checklist, and CISA's guidance maps cleanly onto decisions UK buyers can action this quarter.
- •Restrict administrative tools and privileges to limit lateral movement if a credential is compromised
- •Enforce MFA and formal identity, credential and access management (ICAM) policies across all remote access
- •Patch VPNs, firewalls and other edge devices against CISA's actively exploited vulnerabilities catalogue
- •Isolate backup copies — including M365 data — from the production identity domain so shadow-copy deletion and NAS resets can't reach them
- •Report incidents to law enforcement promptly rather than treating ransom payment as the default path to recovery
View the data behind this chart
| Layer | Detail |
|---|---|
| Initial access | Credential exposure, brute force, VPN/CVE exploitation, phishing |
| Lateral movement | Abuse of admin tools and exposed privileges |
| Backup sabotage | Shadow copy deletion, NAS device resets |
| Double extortion | Data theft plus encryption, leak site threats |
Building the response plan before you need it
Given that SafePay has been active since August 2024 and has reportedly filled much of the gap left by the takedown of LockBit and BlackCat, it is reasonable to assume this group will remain a persistent threat to UK organisations through 2026 and beyond.
The organisations best placed to withstand an incident are those that have already rehearsed it. That means a documented, tested plan — not a policy document sitting unread. Now is the moment to develop your incident response plan, align it with a zero trust approach to internal access, and understand immutable backup for resilience as the final line of defence when prevention and detection both fail.