Overview
Ransomware has evolved from a disruptive malware problem into a structured attack against business operations, identities, infrastructure and recovery capabilities. The latest joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA), FBI and international law-enforcement partners highlights the scale of this threat, reporting that the SafePay ransomware operation has breached more than 600 critical infrastructure organisations worldwide since August 2024. SafePay has targeted organisations across North America, South America, Europe and Australia, using multiple routes into victim environments before moving towards data theft, encryption and extortion. The most important lesson is that ransomware resilience cannot focus solely on preventing encryption. The recovery infrastructure itself has become an attack target.
Initial Access Starts at the Edge
SafePay reportedly gains initial access through exposed or compromised credentials, brute-force attacks, phishing and vulnerabilities affecting internet-facing systems. VPN infrastructure, firewalls and other edge devices are particularly important because they sit directly between the organisation and the internet. A vulnerability or compromised credential at this layer can provide attackers with the foothold required to enter an otherwise well-defended environment. CISA also reports that SafePay actors use automated scripts to exploit common vulnerabilities in edge devices and other internet-exposed systems. This reinforces an important architectural principle: an internet-facing security device is itself a high-value attack surface.
Identity Becomes the First Line of Defence
SafePay’s reported use of exposed credentials, brute-force attacks and phished accounts demonstrates why perimeter security alone is insufficient. Once an attacker obtains valid credentials, activity can appear legitimate. The challenge then shifts from detecting an obviously malicious connection to determining whether the identity is behaving legitimately. Multifactor authentication, strong identity and access management, privileged-account controls and appropriate restrictions on administrative access therefore become critical components of ransomware defence. The objective is not simply to prevent unauthorised login. It is to prevent one compromised identity from becoming a pathway to broader network access.
Lateral Movement Is Where the Blast Radius Grows
After gaining access, ransomware operators need to move through the environment, discover systems and obtain the privileges necessary to maximise impact. CISA and its partners specifically recommend restricting administrative tools and privileges to limit lateral movement. This is where network segmentation and least privilege become practical ransomware controls rather than theoretical security concepts. A compromised workstation should not automatically provide a path to domain administration, file servers, backup infrastructure or security management systems. Reducing trust between systems can significantly reduce the number of resources an attacker can reach after the initial compromise.
Backups Are Part of the Attack Surface
Perhaps the most significant warning in the advisory is SafePay’s reported attempts to disrupt recovery operations by deleting shadow copies and resetting network-attached storage containing backups. This changes the traditional definition of backup security. A backup that can be accessed, modified or deleted using the same compromised administrative identity as production systems is not an independent recovery mechanism. It is another resource inside the attacker’s reach. Recovery architecture therefore needs isolation, restricted administrative access and controls that prevent compromised production credentials from destroying recovery capabilities.
Expert in the Cloud Insight
SafePay’s activity demonstrates why ransomware resilience must be designed as a chain rather than a single security control. Secure the edge. Protect identities. Restrict privilege. Segment the network. Monitor lateral movement. Protect administrative interfaces. Most importantly, isolate recovery infrastructure from the systems it is designed to restore. The objective is not merely to prevent ransomware from executing. The real resilience test is whether the organisation can still recover after the attacker has successfully breached the network.
Leave a Reply