:quality(90):no_upscale()){kind=logo}
US, UK, and German Agencies Issue Joint Advisory on SafePay Ransomware
STATUS: Joint Multinational Advisory SEVERITY: 6/10 AUDIENCE: Government, Defense, Critical Infrastructure Security Leads
Nov 6, 2026
·Blog
·Secure Communications
:quality(90):no_upscale())
In late-October, agencies from the US, the UK, and Germany issued a joint advisory on SafePay ransomware, a group that has hit at least 600 victims across critical infrastructure sectors in North America, South America, Europe, and Australia. The advisory pools investigations by the FBI, CISA, and the Secret Service with German and UK law enforcement and is the latest in a run of multinational warnings this year, a pattern that reflects how little these threats respect borders.
What Happened
Agencies in three countries pooled their investigations into a single advisory on a group whose victims span four regions.
On October 20, CISA, the FBI, and the Secret Service, joined by Germany's Landeskriminalamt Rheinland-Pfalz and the UK's National Crime Agency and North West Regional Organised Crime Unit, released a joint #StopRansomware advisory on SafePay.2 It provides tactics, techniques, procedures, indicators of compromise, and recommendations based on investigations conducted as recently as August 2026.1 Most of the authoring agencies are law enforcement bodies, which reflects the criminal nature of the threat.
SafePay has been active since August 2024 and has affected at least 600 victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia.1 The victims span four regions and the advisory's authors come from three countries. A group operating across borders leaves evidence in several jurisdictions, which makes pooled findings more useful than any single agency's view.
The advisory follows a run of multinational warnings this year. In April, the UK's NCSC and 15 international partners from nine other countries published advice on China-linked covert networks.3 In September, the FBI, the NCSC, and the Netherlands' AIVD each warned that state-sponsored actors are using consumer messaging apps as a primary vector for compromise.4 CI Fortify, issued in May, came from US, Australian, UK, and Canadian agencies.5
The SafePay advisory itself lists initial access through exposed credentials, brute force, phishing, and exploitation of internet-facing systems, including five CVEs dating from 2020 to 2024. Once inside, the actors disable security software, sometimes change users' passwords to prevent legitimate access, stop the Volume Shadow Copy Service, and reset network-attached storage holding backups before stealing data and encrypting.1
What They Found and What It Means
Finding | What It Means | Operational Consequence | Open Question |
Agencies from the US, UK, and Germany released a single advisory on SafePay and most of the authoring agencies are law enforcement bodies. | Several governments are putting their names to the same findings on a group whose victims span four regions. | Organizations that operate in more than one of those countries get one set of tactics and indicators instead of reconciling separate national guidance. | Whether other countries with SafePay victims will join the advisory or publish their own? |
SafePay has affected at least 600 victims across critical infrastructure sectors in North America, South America, Europe, and Australia. | The group's reach extends beyond the countries whose agencies wrote the advisory. | Organizations outside the authoring countries face the same tactics and should treat the advisory as applicable to them. | How consistently affected organizations in regions without an authoring agency receive and act on the advisory? |
The advisory follows other multinational warnings this year, including NCSC-led advice on covert networks and the FBI, NCSC, and AIVD warnings on consumer messaging apps. | Cross-border coordination on cyber threats is becoming a regular way for governments to warn the organizations they protect. | Joint advisories are worth tracking as a distinct category since they mark threats that several governments consider significant enough to warn about together. | Whether response planning at multinational organizations keeps pace with warnings that arrive for every country at once? |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
A national advisory matters mainly to organizations in the country that issued it. | SafePay's advisory has authors in three countries and victims in four regions, so organizations well outside the authoring countries face the same tactics. | BlackBerry® UEM applies the same device-compliance and access policies across a multinational workforce, so one set of controls follows an organization's people across jurisdictions. |
A multinational response can run through the organization's normal email and chat, wherever its people are. | SafePay disables security software and sometimes changes passwords leaving some legitimate users without access, so a response spread across countries and time zones may have no working internal channel. | BlackBerry® AtHoc® is designed to reach staff on mobile devices and phones, outside the organization's internal email and network, so response teams in several countries can be reached at once. |
Joint advisories are general warnings with little operational detail. | The SafePay advisory lists specific CVEs, tools, and behaviors drawn from recent investigations, which security teams can test their controls against. | BlackBerry AtHoc can distribute an advisory's checklist to teams in every region with confirmation of receipt. BlackBerry UEM compliance reporting can show which devices meet the resulting requirements. |
Recommended Actions
IMMEDIATE | Treat the advisory as applicable in every country where you operate and confirm the five CVEs it lists are remediated on internet-facing systems in all regions. |
IMMEDIATE | Require MFA on VPN and privileged accounts across all regions and investigate unexpected account creation, administrative privilege changes, and repeated authentication failures. |
SHORT-TERM | Keep offline, encrypted, immutable backups in a separate location and test restoration since SafePay resets the network storage that holds backups. |
SHORT-TERM | Identify how response teams in each country would reach one another and leadership if directory accounts are locked and internal email is unavailable and test that channel across time zones. |
ONGOING | Track joint multinational advisories as a distinct, higher-priority signal, and assign an owner to translate each one into actions across every region. |
BlackBerry Position
The SafePay advisory reflects governments recognizing that a ransomware group operating across four regions cannot be understood or countered from inside one country. The same applies to the organizations it targets. A multinational operator receives one advisory and has to act on it in every country at once, with security teams, leadership, and local responders spread across time zones. If an intrusion locks out accounts and disables tools, that coordination has to run through a channel outside those systems and it has to be set up before the intrusion because it cannot be built after accounts are locked.
Citations:
1. #StopRansomware: SafePay Ransomware (CISA, FBI, U.S. Secret Service, Landeskriminalamt Rheinland-Pfalz, UK National Crime Agency, and North West Regional Organised Crime Unit, #StopRansomware: SafePay Ransomware, advisory AA26-293A, October 20, 2026).
2. Response to CISA Advisory (AA26-293A): #StopRansomware: SafePay Ransomware (AttackIQ, October 21, 2026).
3. International cyber agencies share fresh advice to defend against China-linked covert networks (UK National Cyber Security Centre, April 2026).
4. UK and allies expose spyware used by Iranian state actors to target dissidents, activists and journalists (Joint advisories from the FBI, UK National Cyber Security Centre, and Netherlands AIVD, The title is Iranian Cyber Targeting of Dissidents, Activists and Journalists, published September 15, 2026. It covers the CHOSEN BRICK malware. NCSC announcement and FBI IC3 advisory PDF. September 15, 2026).
5. CISA Unveils New Initiative to Fortify America’s Critical Infrastructure (CISA and international partners, CI Fortify guidance, May 5, 2026).
:quality(90):no_upscale())