highRansomwareactive19 Oct 2026
SafePay ransomware
The FBI warns of 600+ critical-infrastructure victims
What happened
SafePay operators have hit more than 600 critical-infrastructure organisations, favouring stolen VPN credentials and unpatched edge devices over novel exploits.
Timeline
19 Oct 2026 · 00:00 UTC
Advisory
600+ victims across critical infrastructure are attributed to one crew.20 Oct 2026 · 08:00 UTC
Initial access
Stolen VPN credentials remain the dominant entry path.22 Oct 2026 · 18:00 UTC
Guidance
Offline backups and phishing-resistant MFA are the top recommendations.
Sources