What happened.CISA, the FBI, and allied cyber agencies published joint advisory AA26-293A detailing active intrusion campaigns conducted by the SafePay ransomware group against critical infrastructure organizations.

Why it matters.SafePay operators specifically compromise virtualization layers to disable enterprise recovery mechanisms and force extortion settlements. Infrastructure teams must restrict public management interfaces immediately, mandate hardware security tokens for administrative access, and verify recovery images from isolated offline vaults.