SafePay — Ransomware Profile
SafePay became one of the most active ransomware groups of 2025 with 340+ victims in one year. First observed September 2024. Non-RaaS model with same core operators managing intrusion, encryption, and extortion. Uses stolen credentials, exposed VPN/RDP, and fake IT support call social engineering.IntelFusions coverage (6)
- SafePay ransomware's OneDrive trick exposed other victims 2026-09-02 · Ransomware
- New ransomware crew Za Woo opens with 10 German victims 2026-08-30 · Ransomware
- Nova ransomware outpaces rivals with a global wave of leak claims 2026-07-22 · Ransomware
- Deadlock ransomware floods its leak site with 65 victims in a day 2026-07-11 · Ransomware
- SafePay ransomware names a German airport and charity in leak site surge 2026-07-06 · Ransomware
- Newer ransomware crews claim diagnostics maker Hologic and an Australian fire service 2026-06-28 · Ransomware
Tools & malware
- FileZilla Exfiltration Tool
- PsExec Remote Execution
- SafePay Encryptor Ransomware
- ShareFinder.ps1 Network Reconnaissance
- WinRAR Exfiltration
Recent claimed victims
- industry.airliquide.kr 2026-08-25
- lagegepesca.it 2026-08-24
- granjarinya.com 2026-08-14
- pradotuylaw.com 2026-08-03
- naskdoorinc.com 2026-08-03
- new-point.it 2026-08-03
- simonrack.com 2026-08-03
- hanan-hov.co.il 2026-08-03
- azn.co.jp 2026-08-03
- southshorerecycling.com 2026-08-03
- cpu-ag.com 2026-08-03
- multiaqua.com 2026-08-03
- Although the company in its current industrial form 2026-07-27
- zinorm.de 2026-07-27
- moebelmayer.de 2026-07-27
- paritaet-nrw.org 2026-07-27
- landesmuseum.de 2026-07-27
- hst.eu 2026-07-27
- braywoodschool.co.uk 2026-07-27
- weier.org 2026-07-27
- bnpdist.com 2026-07-27
- upland.k12.ca.us 2026-07-24
- gvsurgicalarts.com 2026-07-24
- wdk.de 2026-07-20
- jaecklin-industrial.de 2026-07-20