Overview
First confirmed activity of SafePay ransomware emerged in September 2024 and since their conception, the group has consistently increased its monthly activity. In March 2025, SafePay ransomware was the fourth most active group, posting 43 confirmed victims to their dark web Data Leak Site (DLS). The group has actively targeted both public and private sectors worldwide, including significant targeting of organisations within the United States (US), Germany, and the United Kingdom (UK). Attacks against the US and German are often conducted in large waves of 10+ attacks a day.
SafePay ransomware operators are reported to gain initial access via victim endpoints through a VPN gateway using valid credentials, likely obtained through stealware or purchasing from dark web markets. The group highly likely also conducts attacks via the exploitation of VPN vulnerabilities, however, know confirmed vulnerabilities are known at this time.
SafePay ransomware threat actors apply the double-extortion technique whereby they exfiltrate data prior to encryption. They demand payment in cryptocurrency and threaten to leak the stolen data on their leak site if the ransom is not paid.
Table of Contents
- Overview
- Potential link Play ransomware
- Impact
- Incident Detection
- Ransom Note
- Affected Products
- Data Leak Snapshot
- Containment, Mitigations & Remediations
- Threat Landscape
- Threat Actor
- Appendix A – Indicators of Compromise (IOC)
- Appendix B – MITRE ATT&CK
- Appendix C – Terminology Yardstick
Key Takeaways
- Why SafePay is a ransomware threat to watch: Understand how this relatively new ransomware group rapidly increased its activity and established itself as a significant threat.
- How SafePay gains access to victim environments Explore the role that compromised credentials, VPN access, and potential exploitation of remote-access vulnerabilities play in SafePay attacks.
- How SafePay increases pressure through double extortion: Learn how the group combines data exfiltration with encryption to increase the operational, financial, and reputational impact on victims.
- Who SafePay is targeting: Discover the sectors and geographies experiencing SafePay activity and how the group conducts attacks at scale.
- Where organizations can strengthen their defenses: Identify security considerations that can help reduce exposure, particularly around identity, credentials, remote access, and ransomware resilience.
