Description Summary
Very active in 2025 (73 victims in June 2025 alone; 270+ named). Centralized, closed non-RaaS group.
Threat Actor
Centralized, closed non-RaaS group; access via compromised VPN credentials, brute force, and IT-impersonation social engineering (email-bombing + phone scams).
Technical Indicators
Encryption Extension
.safepay
Encryption Algorithm
ChaCha20 (per-file key) + RSA/x25519 key wrap
Ransom Note Name
readme_safepay.txt
Targeted Industries
MSPs, Healthcare, Manufacturing
First Seen
September 2024
Last Seen
Active (top-tier through 2025)
Geographical Location
Global (US, Europe; Germany-heavy)
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |