SafePay ransomware targets VPNs and exposed devices; check defenses now
Original title：CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors
What happened
CISA, the FBI and partners issued a joint advisory on SafePay ransomware, which has hit about 600 victims. Attackers use stolen credentials and known flaws in internet-facing devices, often via VPN, then delete backups, steal data and encrypt systems.
Who is affected
- Organizations using VPNs or exposed devices
- Operators of self-managed servers
- Anyone responsible for backups
What to do
Update firmware and OS on VPNs and other internet-facing devices, and require multifactor authentication. Keep offline backups and test restoring them.
Why this flag
攻撃は実際に進行中だが、特定製品の脆弱性ではなく一般的な対策勧告であり、具体的な対象バージョンや CVE は本文に記載がないため。詳細は勧告本文の確認が必要(要確認)。
Yellow flag: caution, slow down — Conditional updates, investigation or recovery follow-ups, and regulatory deadlines.
Sources
- Primary source：CISA News ↗