Search threats, CVEs… ⌘K
← Back to all threat actors

safepay

SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.

How we source and review actor profiles
Motivation
ransomware
First seen
2026-05-01
Last seen
2026-10-26
Sectors
manufacturing, professional-services, technology, retail-e-commerce, healthcare, education, agriculture-and-food-production, other, government-defense, transportation, hospitality, financial-services
Status
Active

Threat intelligence assessment

At a glance

Facts

  • SafePay is one of the most active ransomware groups
  • Emerged in August 2024 as a private ransomware group that does not work with affiliates
  • Has breached over 600 critical infrastructure organizations worldwide since August 2024

Activity timeline

Facts

  • Affected businesses and critical infrastructure in North America, South America, Europe, and Australia
  • Operates a dark web leak site where it lists victims who do not pay
  • Employs double-extortion tactics, stealing sensitive documents before encrypting systems

Attribution assessment

Facts

  • SafePay has filled the gap left by BlackCat (ALPHV) and LockBit ransomware since the start of 2025

Initial access and identity targets

Facts

  • Gains initial access through credential exposure
  • Conducts brute force password attacks
  • Exploits VPN access, particularly using IP addresses of VPN provider Mullvad
  • Uses phished account profiles to infiltrate networks
  • Exploits CVEs for edge devices and other internet-exposed systems through automated scripts

Capabilities and evasion

Facts

  • Disrupts recovery operations by deleting shadow copies and resetting network-attached storage devices containing backups

Observed targeting

Facts

  • Targets multiple critical infrastructure sectors
  • Often targets flaws affecting VPNs, firewalls, and other edge devices for initial access

Defender guidance

Facts

  • Restrict administrative tools and privileges to block lateral movement after compromise
  • Implement multifactor authentication (MFA)
  • Implement identity, credential, and access management (ICAM) policies
  • Keep systems updated, focusing on flaws affecting VPNs, firewalls, and edge devices
  • Do not assume paying ransoms guarantees file recovery; report incidents to law enforcement

Reported detail

Facts

  • SafePay emerged in August 2024 as a private ransomware operation and has compromised over 600 critical infrastructure organizations across multiple continents by October 2026.
  • The group gains initial access primarily through credential exposure, brute force attacks, VPN exploitation (particularly Mullvad), and phishing, combined with CVE exploitation on edge devices.
  • SafePay uses double-extortion tactics and impairs recovery by deleting shadow copies and resetting backups.
  • The group does not affiliate with other attackers and has become one of the most active ransomware operations, partly filling the void left by BlackCat and LockBit since early 2025.
  • CISA and international law enforcement recommend implementing MFA, access controls, system patching, and reporting to authorities rather than paying ransom.

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

First listed
Victim claimlayam.com listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimuaa.mx listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimquevedo-ponce.com listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimmars-semi.com.tw listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimRood Trucking listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimgrifosespinoza.com listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimjumonji-u.ac.jp listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimeveron.com.ar listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimgoldencrops.com.tw listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator5 indicators cataloged

Types: onion.

First observed
CVECVE-2020-3259 linked to this actor

#StopRansomware: SafePay Ransomware

First observed
CVECVE-2023-20269 linked to this actor

#StopRansomware: SafePay Ransomware

First observed
CVECVE-2023-27532 linked to this actor

#StopRansomware: SafePay Ransomware

First observed
CVECVE-2024-40711 linked to this actor

#StopRansomware: SafePay Ransomware

First observed
CVECVE-2024-40766 linked to this actor

#StopRansomware: SafePay Ransomware

First listed
Victim claimhiqbio.com listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimhoteldelfinolugano.ch listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimdwi-bau.de listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimdd-automation.ch listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimstuecheli.ch listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimbwi-bau.de listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimhalservice.it listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimgrundens.com listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimt-systems.com listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimanwo.cl listed by safepay

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 106 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

safepayCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...