Ransomware Group
SafePay
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
Known victims603
Threat level
CRITICAL
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
DiscoveryEnum
- Invoke-ShareFinder
Exfiltration
- 7-Zip
- WinRAR
LOLBAS
- CMSTPLUA
- Regsvr32.exe
- dllhost.exe
Known infrastructure
The following Tor hidden services have been associated with this group:
SafePay BlogSAFEPAYnj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onionSAFEPAYSAFEPAY
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on SafePay’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request