CISA warns on SafePay and Qilin in critical infrastructure

SafePay was the target of a joint alert from CISA, the FBI, the U.S. Secret Service, and partners in Germany and the United Kingdom, which described it as one of the most active ransomware operations and attributed about 600 victims in critical infrastructure sectors across the Americas, Europe, and Australia. In parallel, Hunt.io described Qilin, also tracked as Agenda, as a ransomware-as-a-service operation that gains initial access through stolen credentials and perimeter devices, then uses double extortion and a multiplatform encryptor for Windows, Linux, and ESXi.

What did the SafePay advisory say?

The joint advisory said SafePay affected roughly 600 critical infrastructure organizations, and that the released material includes indicators of compromise, TTPs, response actions, and mitigations. It also urged rapid patching of known exploited vulnerabilities and forensic triage to determine whether a compromise occurred.

Independent coverage of the advisory identified CVE-2020-3259 and CVE-2023-20269 among the vulnerabilities associated with SafePay activity, although that detail should be read as part of the advisory summary and not as confirmation of exploitation in every incident. Security Affairs added that authorities recommended keeping internet-facing devices updated, especially VPNs and firewalls, prioritizing vulnerabilities in CISA’s KEV catalog, and enabling MFA for VPN, webmail, and accounts with access to critical systems.

What TTPs are attributed to SafePay and Qilin?

SafePay gains initial access through exposed credentials, brute-force attacks, and exploitation of perimeter VPN devices, then combines pre-encryption exfiltration with double extortion. Aviatrix also documented the deletion of shadow copies and network-attached storage backups, pointing to a sequence designed to make recovery harder.

Qilin, according to Hunt.io, operates as ransomware-as-a-service and its affiliates gain access through perimeter devices and stolen credentials. The operation uses double extortion and a multiplatform encryptor that targets Windows, Linux, and ESXi, broadening the range of environments it can affect.

What regional reach do these campaigns show?

The available material does not attribute specific incidents to Latin American countries, but it does show that the documented tactics center on vectors that are common in the region, such as VPNs, firewalls, and other internet-exposed devices. In that context, the SafePay alert and Qilin’s technical profile are useful references for critical sectors that depend on those perimeter access points and on reused or stolen credentials.

The official warning focuses on critical infrastructure across several regions and on the need to review exposure, known vulnerabilities, and authentication controls. In SafePay’s case, the joint message also stresses that organizations should conduct forensic reviews if they detect signs of compromise, while Qilin’s profile shows that its affiliates operate under an already industrialized model.

What should be kept in mind about the listed victims?

Public victim lists linked to Qilin and Dire Wolf should be read as claims or public metadata, not as independently confirmed intrusions. That distinction matters to avoid overstating attributions that still depend on case-by-case verification, especially when the material only shows presence in the operation’s site or listings.