Ransomware Intelligence / Groups / safepay
Ransomware group
safepay
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
- 18claims, 7 days
- 30claims, 30 days
- 75claims, 90 days
- 2026-04-06first seen
- 2026-11-04last seen
These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.
Activity, last 26 weeks
New leak-site claims per week.
In the news
Recent stories in the security press that name safepay, newest first.
- FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
- SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
- CISA: SafePay ransomware hit over 600 critical infrastructure orgs
- FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
- #StopRansomware: SafePay Ransomware
Headlines are shown as the publisher wrote them and link to the original story. They are third-party reporting, not SecuritySnares findings. How stories are picked
Sectors claimed, last 90 days
- Manufacturing 13
- Professional services 8
- Healthcare 7
- Construction 6
- Critical infrastructure 6
- Retail 6
- Technology 6
- Government 4
- Higher education 4
- Other 4
- Hospitality 3
- Nonprofit 3
- Financial services 2
- Transportation and logistics 2
- Unclassified 1
Countries claimed, last 90 days
- Germany 11
- United States 10
- Switzerland 8
- Spain 5
- Belgium 4
- Mexico 4
- Taiwan 4
- Argentina 3
- Italy 3
- Japan 3
- Peru 3
- EC 2
- Philippines 2
- Unknown 1
- Austria 1
Vulnerabilities safepay exploits
Our sources do not attribute specific vulnerabilities to safepay .
Newest vulnerabilities used by any ransomware group (CISA KEV)
| Added | CVE | Vendor / product | Vulnerability |
|---|---|---|---|
| 2026-08-18 | CVE-2026-59310 | Broadcom VMware vCenter | Broadcom VMware vCenter Path Traversal Vulnerability |
| 2026-08-05 | CVE-2026-63077 | JetBrains TeamCity | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| 2026-07-29 | CVE-2026-20316 | Cisco Secure Firewall Management Center (FMC) | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
| 2026-07-14 | CVE-2026-15410 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Code Injection Vulnerability |
| 2026-07-14 | CVE-2026-15409 | SonicWall SMA1000 Appliances | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-06-25 | CVE-2026-12569 | PTC Windchill and FlexPLM | PTC Windchill and FlexPLM Improper Input Validation Vulnerability |
| 2026-06-12 | CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability |
Tactics and techniques
MITRE ATT&CK techniques reported for safepay by Ransomware.live, in attack order.
Remote encryption risk. The techniques reported for safepay include encrypting data (T1486) and spreading over SMB / Windows admin shares (T1021.002): the building blocks of remote encryption, where files on protected servers are encrypted over the network from a device the attacker controls.
- Reconnaissance
- Resource Development
-
- Acquire Infrastructure: Domains
- Acquire Infrastructure: Server
- Acquire Infrastructure: Web Services
- Compromise Infrastructure: Domains
- Compromise Infrastructure: Server
- Establish Accounts: Social Media Accounts
- Establish Accounts: Email Accounts
- Develop Capabilities: Malware
- Develop Capabilities: Code Signing Certificates
- Obtain Capabilities: Tool
- Obtain Capabilities: Code Signing Certificates
- Obtain Capabilities: Digital Certificates
- Stage Capabilities: Upload Malware
- Stage Capabilities: Upload Tool
- Initial Access
- Execution
-
- Windows Management Instrumentation
- Scheduled Task/Job: Scheduled Task
- Command and Scripting Interpreter
- Command and Scripting Interpreter: PowerShell
- Command and Scripting Interpreter: Windows Command Shell
- Command and Scripting Interpreter: Visual Basic
- Native API
- Shared Modules
- Exploitation for Client Execution
- User Execution: Malicious Link
- User Execution: Malicious File
- Persistence
-
- Account Manipulation
- Server Software Component: IIS Components
- Pre-OS Boot: Bootkit
- Create or Modify System Process: Windows Service
- Boot or Logon Autostart Execution
- Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- Boot or Logon Autostart Execution: Shortcut Modification
- Hijack Execution Flow: DLL Search Order Hijacking
- Privilege Escalation
- Defense Evasion
-
- Rootkit
- Obfuscated Files or Information
- Obfuscated Files or Information: Software Packing
- Obfuscated Files or Information: Indicator Removal from Tools
- Obfuscated Files or Information: Dynamic API Resolution
- Obfuscated Files or Information: Embedded Payloads
- Obfuscated Files or Information: Encrypted/Encoded File
- Obfuscated Files or Information: Junk Code Insertion
- Masquerading
- Masquerading: Rename Legitimate Utilities
- Masquerading: Masquerade Task or Service
- Masquerading: Match Legitimate Name or Location
- Masquerading: Double File Extension
- Masquerading: Masquerade File Type
- Process Injection
- Process Injection: DLL Injection
- Indicator Removal
- Indicator Removal: Clear Command History
- Indicator Removal: File Deletion
- Indicator Removal: Timestomp
- Modify Registry
- Deobfuscate/Decode Files or Information
- System Binary Proxy Execution
- System Binary Proxy Execution: InstallUtil
- System Binary Proxy Execution: Mshta
- System Binary Proxy Execution: Msiexec
- System Binary Proxy Execution: Regsvr32
- System Binary Proxy Execution: Rundll32
- System Binary Proxy Execution: MMC
- XSL Script Processing
- Template Injection
- File and Directory Permissions Modification
- Virtualization/Sandbox Evasion
- Virtualization/Sandbox Evasion: System Checks
- Virtualization/Sandbox Evasion: Time Based Checks
- Subvert Trust Controls: Code Signing
- Disable or Modify Tools
- Impair Defenses: Disable or Modify System Firewall
- Hidden Artifacts: Hidden Files and Directories
- Hijack Execution Flow
- Hijack Execution Flow: KernelCallbackTable
- Reflective DLL Injection
- Debugger Evasion
- Credential Access
- Discovery
-
- Application Window Discovery
- Query Registry
- System Network Configuration Discovery
- System Owner/User Discovery
- Network Service Discovery
- System Network Connections Discovery
- Process Discovery
- System Information Discovery
- File and Directory Discovery
- Account Discovery: Domain Account
- Automated Collection
- Peripheral Device Discovery
- Time Discovery
- Domain Trust Discovery
- System Location Discovery: System Language Discovery
- Lateral Movement
- Collection
- Command and Control
-
- Data Obfuscation: Protocol or Service Impersonation
- Fallback Channels
- Application Layer Protocol: Web Protocols
- Proxy
- Proxy: Internal Proxy
- Proxy: External Proxy
- Non-Application Layer Protocol
- Web Service
- Web Service: Bidirectional Communication
- Multi-Stage Channels
- Ingress Tool Transfer
- Data Encoding: Standard Encoding
- Remote Access Software: Remote Desktop Software
- Non-Standard Port
- Encrypted Channel
- Encrypted Channel: Symmetric Cryptography
- Exfiltration
- Impact
Track safepay in the weekly brief
One email a week: which groups are active in your sector, what they are exploiting, and what to patch. Drafted from the data on this site and read by a human before it goes out. No sales follow-up.
Data sources: CISA KEV, Ransomchats, RansomLook, Ransomware.live, security news outlets · updated 12 hours ago
Sector, country and ransom-demand figures are SecuritySnares estimates made with a language model. Leak-site listings are claims by threat actors and are not independently verified; leak-site victims are never named unless they have disclosed the incident themselves. News headlines are the publishers' own reporting, shown as written and linked to the original. Methodology