safepay
Known ransomware group ACTIVE Active · high-tempo
SafePay is a ransomware group first observed in late 2024 that quickly became highly active, using LockBit- and ALPHV-derived code. It relies on valid credentials and RDP/VPN access for intrusion and runs a double-extortion leak site.
16
Total Claims
2
Critical
—
Records Claimed
9
Industries Hit
Active span: Apr 17, 2026 – May 18, 2026 · 16 organizations targeted
Active · high-tempo
Actor Threat Profile
Activity Timeline
Peak: May 2026 (13)Apr 2026
LessMore
May 2026Share this profile
Top Targeted Industries
Transportation/Logistics 2
Manufacturing 2
Consumer Services 2
Healthcare 1
Technology 1
Agriculture and Food Production 1
Tradecraft & Infrastructure
6
Documented tools
14 / 156
MITRE tactics / techniques
5
Known leak sites
DiscoveryEnumExfiltrationLOLBAS
Full intelligence profile on ransomware.live →
Targeted Organizations
Claims by safepay
Critical
Ransomware Claim: hautarzt-budihardja.de
hautarzt-budihardja.de
safepay
Ransomware Healthcare
May 19, 2026 Low
Ransomware Claim: gingerichtrucking.com
gingerichtrucking.com
safepay
Ransomware Transportation/Logistics
May 7, 2026 Low
Ransomware Claim: id-s.de
id-s.de
safepay
Ransomware Technology
May 7, 2026 Low
Ransomware Claim: jmige.com
jmige.com
safepay
Ransomware
May 7, 2026 Low
Ransomware Claim: smp.cat
smp.cat
safepay
Ransomware
May 7, 2026 Low
Ransomware Claim: bootstransport.ca
bootstransport.ca
safepay
Ransomware Transportation/Logistics
May 5, 2026 Low
Ransomware Claim: dahlgrenscement.se
dahlgrenscement.se
safepay
Ransomware Manufacturing
May 5, 2026 Low
Ransomware Claim: fital-treppenlifte.de
fital-treppenlifte.de
safepay
Ransomware Consumer Services
May 5, 2026 Low
Ransomware Claim: hokuyo2006.co.jp
hokuyo2006.co.jp
safepay
Ransomware Manufacturing
May 5, 2026 Low
Ransomware Claim: maiadouro.pt
maiadouro.pt
safepay
Ransomware Agriculture and Food Production
May 5, 2026 Low
Ransomware Claim: zonaovest.to.it
zonaovest.to.it
safepay
Ransomware
May 5, 2026 Critical
Ransomware Claim: energyaction.com.au
energyaction.com.au
safepay
Ransomware Energy
May 2, 2026 Low
Ransomware Claim: hpk.hamburg
hpk.hamburg
safepay
Ransomware
May 2, 2026 High
Ransomware Claim: bbalawgroup.com
bbalawgroup.com
safepay
Ransomware Business Services
Apr 18, 2026 High
Ransomware Claim: cheeky.com.ar
cheeky.com.ar
safepay
Ransomware Consumer Services
Apr 18, 2026 High
Ransomware Claim: firstcambodia.com.kh
firstcambodia.com.kh
safepay
Ransomware Hospitality and Tourism
Apr 18, 2026