The Cybersecurity and Infrastructure Security Agency (CISA) reports that the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since August 2024.
The vulnerability or weakness
Initial access to victims' networks is gained through credential exposure, brute force password attacks, and exploiting virtual private network (VPN) access, particularly the IP addresses of the VPN provider 'Mullvad'.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
This breach can lead to significant financial losses, operational disruptions, and potential legal and reputational damage for affected organizations.
Industries affected
Critical infrastructure sectors, including businesses and organizations in North America, South America, Europe, and Australia.
Users affected
Users and customers of these affected organizations may experience service disruptions and potential data loss, impacting their trust and satisfaction.
Build these skills
Sources
- CISA: SafePay ransomware hit over 600 critical infrastructure orgs (BleepingComputer)
