Federal cybersecurity and law enforcement agencies are warning businesses about a ransomware operation that has affected at least 600 organizations worldwide, including companies operating in critical infrastructure sectors.
The group, known as SafePay, has been active since August 2024 and was among the most active ransomware operations in 2026, according to a new federal advisory.