What happened
The FBI and CISA, working with European authorities, published a joint advisory on SafePay, describing the group as one of the most active ransomware operations in the world. The count in the advisory is the part worth pausing on: more than 600 critical infrastructure providers attacked since 2024, weighted toward North and South America, Europe and Australia.
SafePay gets in through compromised credentials, through known vulnerabilities on internet facing devices, and through VPN access. The advisory names two exploited edge device flaws, CVE-2020-3259 and CVE-2023-20269. Once inside, the operators use living off the land techniques, including Windows Remote Management and PsExec, to execute commands on remote systems. They disable security software before moving laterally, pivot with Remote Desktop Protocol, and hunt for credentials that grant administrative access. FileZilla, 7-Zip and WinRAR are used to package data. WinSCP and RClone are used to exfiltrate it to accounts the attackers control.
Halcyon's Cynthia Kaiser told Cybersecurity Dive that volume appears to have peaked at the end of 2025, but the group has still targeted roughly 15 to 30 organisations every month through 2026. The advisory points to the July 2025 Ingram Micro incident, where order processing was disrupted for days and personal data belonging to more than 42,000 people was taken.
The recommended mitigations are short: remediate known exploited vulnerabilities, apply identity and access management policy with multifactor authentication particularly for VPN accounts, keep offline encrypted immutable backups, and segment networks.
Why this is a GRC story
There is nothing new in the guidance, and that is the finding. Every recommendation in the advisory maps onto a control the average enterprise already reports as implemented. Vulnerability management, multi factor authentication, immutable backups, network segmentation. An advisory like this is not new information. It is a test of whether the evidence behind those claims exists on paper and in practice.
Initial access was an identity event. Credentials and VPN accounts were the doorway, which puts identity governance at the centre of the response rather than at the edge. Dormant VPN accounts, shared administrative credentials and service accounts with no owner are not hypothetical risks in this pattern. They are the pattern. If an access review has not touched VPN and remote access accounts this quarter, that review is incomplete.
Immutable backups are a board conversation, not an IT one. An offline, encrypted, immutable copy is the difference between a bad week and a business ending event. The governance question attached to it is simple and uncomfortable: when was the last documented restore test, and who signed it off. And with 600 victims across critical infrastructure, the exposure is structural. Being average in a sector this exposed is not a position anyone should defend in a board paper.
What to watch
Watch whether a sector regulator or a major insurer formally references the advisory in guidance or underwriting questions. That is the point at which an intelligence product becomes a compliance expectation, usually within a quarter.
The practical move is small. Take the four recommendations from the advisory, ask for one piece of evidence for each, and put the gaps in front of whoever owns risk acceptance. That is half a day of work and it produces a defensible answer to the question every board asks.
Attribution: Analysis based on Cybersecurity Dive and related public reporting. This article is original commentary, not a repost of the source material.