safepay
Known ransomware group ACTIVE Currently active
SafePay is a ransomware group first observed in late 2024 that quickly became highly active, using LockBit- and ALPHV-derived code. It relies on valid credentials and RDP/VPN access for intrusion and runs a double-extortion leak site.
20
Total Claims
4
Critical
—
Records Claimed
11
Industries Hit
Active span: Apr 17, 2026 – Oct 31, 2026 · 20 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: May 2026 (13)Apr 2026
LessMore
Oct 2026Share this profile
Top Targeted Industries
Healthcare 3
Transportation/Logistics 2
Manufacturing 2
Consumer Services 2
Transportation 1
Government & Defense 1
Tradecraft & Infrastructure
0
Documented tools
14 / 156
MITRE tactics / techniques
5
Known leak sites
Targeted Organizations
Claims by safepay
Low
Ransomware Claim: Rood Trucking
Rood Trucking
safepay
Ransomware Transportation
Nov 1, 2026 Critical
Ransomware Claim: bio-strath.com
bio-strath.com
safepay
Ransomware Healthcare
Sep 28, 2026 Critical
Ransomware Claim: triniticaring.org
triniticaring.org
safepay
Ransomware Healthcare
Sep 16, 2026 Low
Ransomware Claim: gob.pe
gob.pe
safepay
Ransomware Government & Defense
Sep 16, 2026 Critical
Ransomware Claim: hautarzt-budihardja.de
hautarzt-budihardja.de
safepay
Ransomware Healthcare
May 19, 2026 Low
Ransomware Claim: gingerichtrucking.com
gingerichtrucking.com
safepay
Ransomware Transportation/Logistics
May 7, 2026 Low
Ransomware Claim: id-s.de
id-s.de
safepay
Ransomware Technology
May 7, 2026 Low
Ransomware Claim: jmige.com
jmige.com
safepay
Ransomware
May 7, 2026 Low
Ransomware Claim: smp.cat
smp.cat
safepay
Ransomware
May 7, 2026 Low
Ransomware Claim: bootstransport.ca
bootstransport.ca
safepay
Ransomware Transportation/Logistics
May 5, 2026 Low
Ransomware Claim: dahlgrenscement.se
dahlgrenscement.se
safepay
Ransomware Manufacturing
May 5, 2026 Low
Ransomware Claim: fital-treppenlifte.de
fital-treppenlifte.de
safepay
Ransomware Consumer Services
May 5, 2026 Low
Ransomware Claim: hokuyo2006.co.jp
hokuyo2006.co.jp
safepay
Ransomware Manufacturing
May 5, 2026 Low
Ransomware Claim: maiadouro.pt
maiadouro.pt
safepay
Ransomware Agriculture and Food Production
May 5, 2026 Low
Ransomware Claim: zonaovest.to.it
zonaovest.to.it
safepay
Ransomware
May 5, 2026 Critical
Ransomware Claim: energyaction.com.au
energyaction.com.au
safepay
Ransomware Energy
May 2, 2026 Low
Ransomware Claim: hpk.hamburg
hpk.hamburg
safepay
Ransomware
May 2, 2026 High
Ransomware Claim: bbalawgroup.com
bbalawgroup.com
safepay
Ransomware Business Services
Apr 18, 2026 High
Ransomware Claim: cheeky.com.ar
cheeky.com.ar
safepay
Ransomware Consumer Services
Apr 18, 2026 High
Ransomware Claim: firstcambodia.com.kh
firstcambodia.com.kh
safepay
Ransomware Hospitality and Tourism
Apr 18, 2026