safepay ransomware group

SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.

Claims in 7 days: 2
Claims in 30 days: 19
Reported techniques: 40

Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.

Where it claims victims

Country	Claims in 60 days
Germany	3
Israel	2
United States	2
Belgium	2
Taiwan	2
Thailand	1
Australia	1
Spain	1

Sectors

Sector	Claims in 60 days
Other	5
Manufacturing	3
Education	3
Hospitality	1
Professional Services	1
Transportation	1
Agriculture and Food Production	1

Reported techniques

Valid Accounts Replication Through Removable Media Drive-by Compromise Exploit Public-Facing Application Phishing Windows Management Instrumentation Scheduled Task/Job Command and Scripting Interpreter Native API Shared Modules Exploitation for Client Execution User Execution Account Manipulation Server Software Component Pre-OS Boot Create or Modify System Process Boot or Logon Autostart Execution Hijack Execution Flow Access Token Manipulation Rootkit Obfuscated Files or Information Masquerading Process Injection Indicator Removal Deobfuscate/Decode Files or Information System Binary Proxy Execution XSL Script Processing Template Injection Virtualization/Sandbox Evasion Hide Artifacts Reflective Code Loading Debugger Evasion OS Credential Dumping Input Capture Brute Force Credentials from Password Stores Adversary-in-the-Middle Application Window Discovery Query Registry System Network Configuration Discovery

Ransomware tracker