#StopRansomware: SafePay Ransomware

**Advisory:** A joint FBI/CISA/USSS and international advisory documents the SafePay ransomware group's widespread activity (since August 2024) affecting at least 600 victims across critical infrastructure and multiple regions; it details initial access vectors (credential theft, brute force, VPN abuse, CVE exploitation), LOTL lateral movement (PsExec, WinRM, RDP), credential theft and exfiltration tools (Mimikatz, RClone, FileZilla), encryption behavior (.SafePay using ChaCha20+RSA), IOCs (IPs, filenames, hashes, hostnames), and prescribes mitigations and incident response actions for defenders.