Cybersecurity Best Practices for Infrastructure Start With Access
For an infrastructure team, 600 reported victims isn’t an abstract threat statistic. It’s a reminder that an incident can begin with one exposed credential or an internet-facing device, then become an operations problem while responders are still figuring out what was touched. CISA says SafePay has affected at least 600 organizations across critical infrastructure sectors since August 2024. The group’s reach spans North and South America, Europe and Australia. That scale should change how teams think about readiness: not as a checklist for the security department, but as a plan for keeping essential work moving when trusted access is no longer trustworthy.
The joint advisory described by BleepingComputer was issued with the FBI, U.S. Secret Service, German police and UK law-enforcement partners. It reports several initial-access routes: exposed credentials, brute-force password attacks and abuse of VPN access. The agencies also highlighted exploitation of vulnerabilities in VPNs, firewalls and other edge devices. SafePay’s reported activity is therefore not a story about a single magic exploit. It is a chain of opportunities—an account, a perimeter device, then privileges and network paths that let an intruder do more.
That chain matters because the first foothold and the eventual impact are different problems. A login that looks valid may bypass controls aimed only at blocking malware. Once inside, an attacker can seek administrative tools, move across systems, steal documents and interfere with recovery. Defenses have to meet each step, not just the moment a file is encrypted.
What Is Cybersecurity in This SafePay Example?
Cybersecurity is often described as protecting systems, networks and information from attack. That’s true, but for an infrastructure operator the practical question is sharper: which identities can reach which systems, what can they do there, and can the organization restore service if those systems are compromised?
SafePay illustrates how those concerns intersect. Identity is the front door when attackers use exposed or guessed credentials and phished account profiles. Network access is the route from a foothold to other systems; VPNs and internet-facing appliances deserve close attention because the advisory identifies them as both access paths and targets for vulnerability exploitation. Data protection matters because SafePay uses double extortion: the group steals sensitive documents before encrypting systems and threatens to publish the stolen material. Recovery is tested when attackers delete shadow copies or reset network-attached storage devices containing backups.
These aren’t separate boxes to tick. Stronger account controls can make stolen passwords less useful, but they do not patch an exposed firewall. A patched edge device won’t prevent an intruder with valid credentials from abusing excessive privileges. And a backup that shares the same reachable environment as production may be vulnerable to the same attacker. The useful cybersecurity model here is a connected one: identity, segmentation and access limits reduce what an intruder can reach; data controls reduce the value and exposure of stolen information; recovery arrangements give the organization a way back when prevention fails.
That’s the more useful answer to “What is cybersecurity?” than a catalogue of technologies. It is the work of reducing the chance of compromise and limiting what compromise can do. The SafePay advisory offers a concrete case, not proof that every victim had the same weakness or that any single control would have stopped every incident.
Types of Threats and the Routes They Use
SafePay’s reported methods cover familiar threat categories: credential abuse, brute force, phishing-related account access, exploitation of known vulnerabilities, data theft and ransomware encryption. Treating these as unrelated incidents misses the campaign logic. Attackers can use different means to get in, then apply similar pressure—disrupt systems, threaten disclosure and make recovery harder.
The advisory calls out edge-device flaws and other internet-exposed systems, including vulnerabilities tracked in CISA’s Known Exploited Vulnerabilities catalog. That catalog is a useful prioritization signal: it focuses attention on flaws known to be exploited, rather than leaving teams to treat every vendor update as equally urgent. For infrastructure operators, the practical work is to inventory perimeter devices, identify affected products and versions, and prioritize remediation of vulnerabilities in exposed systems. If immediate patching isn’t possible, teams need a clear mitigation and follow-up plan rather than an undocumented exception.
CISA also specifically warns defenders to restrict administrative tools and privileges to impede lateral movement. That advice connects the perimeter to internal operations. If an account is compromised, limiting its authority and the systems it can reach can prevent an initial intrusion from turning into broad control of the environment. MFA and identity, credential and access management policies add friction to account abuse and help teams manage who has access. They’re not a substitute for patching or monitoring; they address a different link in the chain.
Make Recovery Harder to Disrupt
SafePay’s reported deletion of shadow copies and resetting of network-attached storage devices is the detail infrastructure leaders should sit with. A backup is not resilient merely because a job reports success. If attackers who reach the network can erase or alter the recovery copies, the organization may have backups without a usable way to restore operations.
The advisory’s warning supports a practical test: assess whether backup systems and recovery credentials are protected from the same accounts and network paths used for routine administration. Then rehearse restoration, including who can authorize it, what systems must return first and how teams will validate recovered data. The source does not prescribe a particular backup architecture; the point is to take seriously its warning that attackers may target recovery itself. A restore plan that has never been exercised is an assumption, not a capability.
Data theft adds another complication. Even if systems can be restored, recovery does not make stolen documents private again. Organizations need to understand what sensitive data is held where, limit unnecessary access, and include disclosure and incident-reporting decisions in response planning. CISA and its partner agencies say paying a ransom does not guarantee recovery of encrypted files, and they urge victims to report incidents to law enforcement. Payment, in other words, is not a dependable continuity strategy.
A Practical Readiness Review
Infrastructure teams can turn the SafePay warning into a focused review without pretending one checklist eliminates ransomware:
- Confirm MFA and account-management controls cover remote access and privileged accounts; remove access that is no longer needed.
- Review VPNs, firewalls and other internet-facing systems for known exploited vulnerabilities, and document remediation or mitigation decisions.
- Limit administrative privileges and tools, and check whether ordinary accounts can reach systems they do not need.
- Verify that backup copies and their management paths are protected from compromise of the production environment; test restoration rather than relying on job status.
- Know what sensitive data could be stolen, and establish incident reporting and response procedures before an extortion demand arrives.
These actions are less satisfying than a promise of prevention. They’re also more honest. No single technology—MFA, endpoint protection, a firewall rule or a backup product—covers the whole sequence CISA describes. The task is to make each transition harder: from exposed access to a valid session, from a foothold to privileged movement, and from encryption to a prolonged outage.
What the 600-Organization Figure Does—and Doesn’t—Say
CISA’s figure is at least 600 affected organizations since August 2024, across multiple critical infrastructure sectors and several regions. BleepingComputer reports that SafePay’s leak site lists victims who do not pay, meaning the site does not show the full number the group may have breached or attempted to extort. The figure is a serious measure of campaign reach, but it isn’t a complete incident census, and it doesn’t establish that all victims suffered the same operational impact.
That distinction doesn’t soften the lesson. SafePay’s activity puts identity, exposed infrastructure, data protection and recoverability in the same frame. Cybersecurity best practices for infrastructure are the controls that connect those areas—and the rehearsed decisions that keep an attack from becoming an avoidable, prolonged outage.
Source: BleepingComputer’s report on the joint SafePay advisory.