[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fV4wR3UfgCM_nPT760I3isUIXQm6wNO2UwShF5OR3qhk":3},{"article":4,"iocs":53,"watch_terms":60,"solutions":61,"lesson":32},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"c0e8d38c-3e2c-4eeb-8b7c-e90977f552c5","FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations","fbi-and-cisa-warn-of-safepay-ransomware-attacks-on-600-organizations-249586","SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most […]","The FBI, CISA, and international law enforcement agencies have issued a joint advisory regarding the SafePay ransomware group, which has targeted over 600 organizations since mid-2024. The group utilizes stolen credentials, VPN access, and exploits known vulnerabilities in edge devices, including Cisco and Veeam products, to gain initial access. SafePay employs double extortion tactics, demanding cryptocurrency for data decryption and threatening to leak exfiltrated data.","FBI and CISA warn of SafePay ransomware attacks impacting over 600 organizations globally.","https:\u002F\u002Fsecurityaffairs.com\u002F201464\u002Fcyber-crime\u002Ffbi-and-cisa-warn-of-safepay-ransomware-attacks-on-600-organizations.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2015\u002F02\u002FRule-41-google-fbi-2.jpg","2026-10-22T06:48:43+00:00","2026-10-23T15:09:05.72288+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"SafePay","threat_actor",{"name":21,"type":22},"Cisco","vendor",{"name":24,"type":22},"Veeam",{"name":26,"type":22},"SonicWall",{"name":28,"type":29},"Mullvad VPN","product","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":30,"icon":32,"name":33,"slug":34},null,"Ransomware","ransomware",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,56],{"type":47,"value":18,"context":55},"Ransomware variant name",{"type":57,"value":58,"context":59},"mitre_attack","T1110","Brute force password attacks",[21,26,24],{"controls":62,"vendors":149},[63,91,120],{"slug":64,"name":65,"problem":66,"products":67},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[68,75,83],{"vendor_slug":69,"vendor_name":21,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":92,"name":93,"problem":94,"products":95},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":121,"name":122,"problem":123,"products":124},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",[150,153],{"slug":69,"name":21,"logo_path":70,"roles":151},[152],"affected",{"slug":154,"name":24,"logo_path":155,"roles":156},"veeam","\u002Fvendor-logos\u002Fveeam.png",[152]]