🌐 SafePay¶
Threat-actor battle card · maintained from public sources · last updated 2026-11-03
Overview¶
SafePay emerged in September 2024 as a centrally operated, non-RaaS ransomware group. Unlike most extortion operations, it develops its own encryptor, manages its own infrastructure, and conducts negotiations directly — no affiliates. It claimed 300+ victims by mid-2025, surpassed 537+ by August 2026, and a joint CISA/FBI/US Secret Service advisory (with Germany's LKA Rheinland-Pfalz and the UK's National Crime Agency/NW Regional Organised Crime Unit) put the cumulative count at 600+ organizations since August 2024 as of Oct 20, 2026, calling it among the most active ransomware groups of the year and noting the toll has been run up without a single zero-day — all exploited CVEs (CVE-2023-27532, CVE-2024-40711, CVE-2024-40766) were already known and patchable. The US remains the primary target (206 victims), followed by Germany (125), UK (33), Canada, and Australia; critical-infrastructure sectors feature prominently per the advisory. Over 90% of victims are small and mid-sized businesses (Flare IO analysis of 500+ attacks). The DLS went temporarily inactive mid-March to early April 2026 (reason undisclosed) then resumed; Q1 2026 showed a notable dip (22 victims vs 97 in Q4 2025) but pace recovered in Q2-Q3, and NCC Group named it the single most active ransomware group in May 2026 (70 claimed attacks that month) with BlackKite separately ranking it 3rd-most-active over the first four months of 2026. 27 new victims in the 30 days to August 3, 2026, remains the most recent monthly-pace figure sourced; a current November DLS count could not be independently corroborated this update (ransomware.live/RansomLook unreachable this pass). A CIS-country exclusion kill-switch (Cyrillic language check halts execution) and avoidance of CIS-country targets suggest Eastern European origin — circumstantial, not a named government attribution. The group also operates a TON (Telegram Open Network) channel for affiliate communications and leak notifications.
Tradecraft¶
- Initial access: primarily through vulnerable edge devices — VPN gateways, firewalls, Remote Desktop Gateway servers; also targets MSPs with downstream multi-tenant access.
- Reconnaissance: ShareFinder.ps1 (PowerTools) enumerates network, SMB shares, and accessible assets immediately post-access.
- Lateral movement: living-off-the-land binaries (PSExec, WinRM, RDP) and legitimate RMM software.
- Evasion: disables security services, eliminates backup software, halts Volume Shadow Copy; token impersonation for privilege escalation where needed.
- Exfiltration: WinRAR, 7-Zip, Rclone, FileZilla, RDP clipboard.
- Encryption: the Oct 2026 joint advisory describes a ChaCha20/RSA hybrid scheme; earlier vendor analyses described AES+RSA — treat as the scheme being clarified/updated in the advisory rather than a contradiction. Includes a mutex-based control to avoid re-encrypting devices already hit.
- Extortion: double-extortion (decryption key + DLS publication) plus pressure tactics — email bombing and vishing/IT-helpdesk-impersonation calls to push victims toward installing remote-access tools.
- Lineage: code/binary overlap with the leaked LockBit Black builder (Blackpoint, Huntress) — tooling lineage, not evidence of a LockBit affiliation.
- Employs Conti-lineage TTPs including spam phishing with custom loaders and ESXi/Citrix appliance targeting.
Notable victims¶
- Ingram Micro (technology distribution/US) — attack July 2–3, 2025; 3.5TB claimed exfiltrated; ~42,000 individuals notified January 2026; Social Security Numbers, financial data, and business records exposed; largest publicly attributed SafePay victim to date by organisational scale
- Energy Action (energy management/Australia) — ~470GB claimed, under investigation — seen June 2026
- hellmold-plank.de (manufacturing/Germany — est. 1904) — DLS June 27, 2026; data scope unconfirmed; 🟥 unverified
- Hokuyo 2006 Co., Ltd. (manufacturing/packaging-logistics/Japan) — DLS May 4, 2026; 🟥 unverified
- Tokyo Civil Co., Ltd. (civil engineering/Japan) — DLS June 26, 2026; 🟥 unverified
- Kawai Musical Instruments (manufacturing/Japan) — DLS June 15, 2026; 🟥 unverified
- Hugh Stirling Ltd (construction/UK) — DLS June 15, 2026; 🟥 unverified
- Compunnel Software Group (IT consulting/digital engineering, US) — DLS Sep 11, 2026; 🟥 unverified
- Ryomo Co., Ltd. (Japan) — DLS Sep 15, 2026; 🟥 unverified
- Neumerkel GmbH (manufacturing/Germany) — DLS Sep 15, 2026; 🟥 unverified
Assessment¶
SafePay's in-house model eliminates the affiliate interdiction playbook; there is no affiliate network to penetrate or flip. Its 90%+ SMB targeting concentration means organisations too small to run a mature IR programme are being hit hardest. Conti-lineage TTPs, a rapid climb from zero to global top-6 in under 18 months, edge-device initial-access focus, and a track record built entirely on already-patchable CVEs (per the Oct 2026 joint advisory) make it a high-severity risk for any organisation running internet-exposed, unpatched VPN or firewall infrastructure. Healthcare, finance, manufacturing, and now explicitly critical-infrastructure sub-sectors running unpatched edge devices or MSP-managed environments should treat themselves as in-scope. The mid-March to early April 2026 DLS outage resolved without public explanation — likely infrastructure migration rather than disruption; the group remains fully operational, and the Oct 20 advisory's "among the most active 2026 groups" framing plus the May 2026 NCC Group #1 ranking argue against any read of this group as declining. No government has attributed SafePay to a specific country; treat the Eastern European/Russian-origin read as circumstantial (Cyrillic kill-switch, CIS avoidance, VPN-based IP masking) pending a named-source attribution.
Sources¶
- ThreatLocker — SafePay ransomware explained: IOCs, TTPs, and defense strategies
- Bitdefender — SafePay Ransomware: How a Non-RaaS Group Executes Rapid Fire Attacks
- Blackpoint Cyber — SafePay Ransomware Threat Profile
- Infosecurity Magazine — Unmasking the SafePay Ransomware Group
- SOCPrime — SafePay Ransomware: Centralized Double-Extortion Group
- SureFire Cyber — Threat Actor Profile: SafePay Ransomware Group
- Flare IO — SafePay Ransomware: Mapping the Real Victims Behind the Leak Sites
- Flare IO — 90% of SafePay Ransomware Victims are SMBs
- Halcyon — SafePay threat group profile
- Acronis — SafePay ransomware: The fast-rising threat targeting MSPs
- CISA/FBI/US Secret Service joint advisory AA26-293A — #StopRansomware: SafePay Ransomware (Oct 20, 2026)
- The Record — FBI says SafePay ransomware gang among most active, 600+ victims
- Quorum Cyber — SafePay ransomware report
- Blackpoint Cyber — SafePay threat profile (LockBit Black builder lineage)
🗂️ Attacks & victims¶
All disclosed victims attributed to this actor, newest first.
September 2026
July 2026
June 2026
May 2026