What Happened
BleepingComputer reports CISA and the FBI published a joint advisory on SafePay ransomware on October 21. German and UK police agencies and the US Secret Service co-authored it. The advisory counts at least 600 critical infrastructure victims since August 2024. The real total is higher, because the count covers only victims who refused to pay and appear on the leak site.
SafePay works alone and does not use affiliates. It steals documents, encrypts systems, and threatens to leak the data. Initial access comes from exposed credentials, brute-force attacks, VPN exploitation, phished accounts, and automated scripts against edge device flaws. After entry, the group deletes volume shadow copies and resets network-attached storage holding backups. Victims sit in North America, South America, Europe, and Australia.
Why This Matters for Canadian Organizations
The advisory does not name Canada or the Canadian Centre for Cyber Security. The tradecraft still applies to Canadian utilities, hospitals, municipalities, and manufacturers. They run the same VPNs, firewalls, and NAS backups as the victims listed.
Attackers who reset backups remove your recovery option. A Canadian operator without offline copies then faces a hard choice between paying and a long outage. A stolen-data leak also triggers PIPEDA breach reporting and, for regulated sectors, notice to the sector regulator.
What to Do
Patch VPNs, firewalls, and other edge devices first, starting with flaws in the CISA KEV catalog. Enforce multifactor authentication on every remote access path. Restrict administrative tools to limit lateral movement.
Keep at least one backup copy offline and test restores. Alert on shadow copy deletion and on bulk changes to NAS devices. Watch logins from consumer VPN address ranges, which the advisory ties to SafePay activity. Report incidents to the Canadian Centre for Cyber Security and to law enforcement. Read more in our Trends archive.
