SafePay — Ransomware Profile
SafePay became one of the most active ransomware groups of 2025 with 340+ victims in one year. First observed September 2024. Non-RaaS model with same core operators managing intrusion, encryption, and extortion. Uses stolen credentials, exposed VPN/RDP, and fake IT support call social engineering.IntelFusions coverage (9)
- Vietnam's Mat Bao and Thai Lion Air land on leak sites 2026-10-04 · Cyber Incidents
- Ransomware crew appears to be writing its wipers with AI 2026-09-17 · Ransomware
- More ransomware crews, but far fewer victims each 2026-09-13 · Ransomware
- SafePay ransomware's OneDrive trick exposed other victims 2026-09-02 · Ransomware
- New ransomware crew Za Woo opens with 10 German victims 2026-08-30 · Ransomware
- Nova ransomware outpaces rivals with a global wave of leak claims 2026-07-22 · Ransomware
- Deadlock ransomware floods its leak site with 65 victims in a day 2026-07-11 · Ransomware
- SafePay ransomware names a German airport and charity in leak site surge 2026-07-06 · Ransomware
- Newer ransomware crews claim diagnostics maker Hologic and an Australian fire service 2026-06-28 · Ransomware
Tools & malware
- FileZilla Exfiltration Tool
- PsExec Remote Execution
- SafePay Encryptor Ransomware
- ShareFinder.ps1 Network Reconnaissance
- WinRAR Exfiltration
Recent claimed victims
- hiqbio.com 2026-10-12
- hoteldelfinolugano.ch 2026-10-09
- dwi-bau.de 2026-10-09
- dd-automation.ch 2026-10-05
- stuecheli.ch 2026-10-05
- bwi-bau.de 2026-10-05
- halservice.it 2026-10-05
- grundens.com 2026-10-05
- t-systems.com 2026-10-05
- anwo.cl 2026-10-05
- duhaas.sk 2026-10-05
- ikhasas.com 2026-10-05
- sterrer.net 2026-10-05
- econ-tec.com 2026-09-30
- assist2enjoy.be 2026-09-30
- wolfusofsky.de 2026-09-30
- lfgholding.com 2026-09-28
- fedelmundo.com.ph 2026-09-28
- bio-strath.com 2026-09-28
- sumperk.cz 2026-09-28
- eagroep.com 2026-09-28
- Holiday Inn Vilnius 2026-09-28
- manno.ch 2026-09-28
- auromex.com 2026-09-28
- cromados.com 2026-09-28