Agencies warn of malicious activity by SafePay ransomware group

A joint advisory issued Oct. 20 by U.S. and international agencies warns of recent activity by the SafePay Ransomware group. The group has been active since 2024, attacking critical infrastructure organizations, including healthcare, across North America and around the world. The agencies said SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems and using phishing tactics. The actors then gain control of the network by creating new accounts or taking over existing ones and use legitimate system tools to move through the network to identify valuable files and disable security protections. Next, the actors encrypt the victim's files and leave a ransom note demanding payment in cryptocurrency. The advisory includes recommended security measures to reduce the risk of SafePay ransomware attacks.

For more information on this or other cyber and risk issues, contact John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org, or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity