A relatively new strain of ransomware, SafePay, is said by researchers to be responsible for more attacks than any other in the last month.
Learn more about it, and how it is different from other ransomware, in my article on the Fortra blog:
www.fortra.com/blog/safepay...
Learn more about it, and how it is different from other ransomware, in my article on the Fortra blog:
www.fortra.com/blog/safepay...
SafePay Ransomware: What You Need To Know
SafePay breaks the mold by rejecting RaaS. Discover how this ransomware group operates and why it’s gaining ground fast.
www.fortra.com
June 27, 2025 at 11:00 AM
A relatively new strain of ransomware, SafePay, is said by researchers to be responsible for more attacks than any other in the last month.
Learn more about it, and how it is different from other ransomware, in my article on the Fortra blog:
www.fortra.com/blog/safepay...
Learn more about it, and how it is different from other ransomware, in my article on the Fortra blog:
www.fortra.com/blog/safepay...
🧵Today’s blogpost focuses on a newer ransomware variant named SafePay. Needless to say, ransomware sucks. When this new variant appeared, it gained our attention. 👀
Let’s dig into what happened and what makes it tick ⬇️:
Let’s dig into what happened and what makes it tick ⬇️:
November 15, 2024 at 3:29 AM
🧵Today’s blogpost focuses on a newer ransomware variant named SafePay. Needless to say, ransomware sucks. When this new variant appeared, it gained our attention. 👀
Let’s dig into what happened and what makes it tick ⬇️:
Let’s dig into what happened and what makes it tick ⬇️:
#ThreatActors to Watch: #SafePay, #FancyBear, and #ShinyHunters - #CYJAX
www.cyjax.com/resources/bl...
www.cyjax.com/resources/bl...
Threat Actors to Watch: SafePay, FancyBear, and ShinyHunters - CYJAX
From a fast-scaling ransomware operator to a Russian state-sponsored espionage group now experimenting with LLM-powered malware, and a data extortion collective that has weathered arrests without slow...
www.cyjax.com
September 23, 2026 at 2:05 AM
#ThreatActors to Watch: #SafePay, #FancyBear, and #ShinyHunters - #CYJAX
www.cyjax.com/resources/bl...
www.cyjax.com/resources/bl...
some huntress homies cooked a blog on a new ransom group called safepay
RE was fun until we realized it was ripped lockbit code 💀😭 imagine not being able to write your own ransomware, true skill issue smh
some funny opsec fails too, watch ya status
www.huntress.com/blog/its-not...
RE was fun until we realized it was ripped lockbit code 💀😭 imagine not being able to write your own ransomware, true skill issue smh
some funny opsec fails too, watch ya status
www.huntress.com/blog/its-not...
https://www.huntress.com/blog/its-not-safe-to-pay-safepay
t.co
November 14, 2024 at 7:38 PM
some huntress homies cooked a blog on a new ransom group called safepay
RE was fun until we realized it was ripped lockbit code 💀😭 imagine not being able to write your own ransomware, true skill issue smh
some funny opsec fails too, watch ya status
www.huntress.com/blog/its-not...
RE was fun until we realized it was ripped lockbit code 💀😭 imagine not being able to write your own ransomware, true skill issue smh
some funny opsec fails too, watch ya status
www.huntress.com/blog/its-not...
An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned.
Ingram Micro outage caused by SafePay ransomware attack
An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned.
www.bleepingcomputer.com
July 5, 2025 at 3:59 PM
An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned.
The new SafePay ransomware gang has claimed responsibility for the attack on UK telematics biz Microlise, giving the company less than 24 hours to pay its extortion demands before leaking data. www.theregister.com/2024/11/22/s...
SafePay ransomware gang claims attack on UK's Microlise
Fledgling band of crooks says it stole 1.2 TB of data
www.theregister.com
November 22, 2024 at 10:28 AM
The new SafePay ransomware gang has claimed responsibility for the attack on UK telematics biz Microlise, giving the company less than 24 hours to pay its extortion demands before leaking data. www.theregister.com/2024/11/22/s...
#IngramMicro outage caused by SafePay #ransomware attack
"Sources have told BleepingComputer that it is believed the threat actors #breached Ingram Micro through its #GlobalProtect #VPN platform..."
www.bleepingcomputer.com/news/securit...
"Sources have told BleepingComputer that it is believed the threat actors #breached Ingram Micro through its #GlobalProtect #VPN platform..."
www.bleepingcomputer.com/news/securit...
Ingram Micro outage caused by SafePay ransomware attack
An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned.
www.bleepingcomputer.com
July 6, 2025 at 5:17 PM
#IngramMicro outage caused by SafePay #ransomware attack
"Sources have told BleepingComputer that it is believed the threat actors #breached Ingram Micro through its #GlobalProtect #VPN platform..."
www.bleepingcomputer.com/news/securit...
"Sources have told BleepingComputer that it is believed the threat actors #breached Ingram Micro through its #GlobalProtect #VPN platform..."
www.bleepingcomputer.com/news/securit...
Safepay ransomware claims an attack on Verzolla, an Italian supplier of industrial components and automation systems, reportedly impacting organizations in Italy. #Italy #Ransomware #Automation
Ransom! verzolla.com (JUN-2026)
Safepay ransomware operators targeted verzolla.com, an Italian industrial components and automation systems supplier operating in Italy. The attack impacted organizations in #Italy
www.hendryadrian.com
June 2, 2026 at 9:15 AM
Safepay ransomware claims an attack on Verzolla, an Italian supplier of industrial components and automation systems, reportedly impacting organizations in Italy. #Italy #Ransomware #Automation
🚨🇺🇸 Waverly Child Care & Preschool has Fallen Victim to SAFEPAY Ransomware
September 10, 2025 at 7:19 PM
🚨🇺🇸 Waverly Child Care & Preschool has Fallen Victim to SAFEPAY Ransomware
SafePay Ransomware Strikes 260+ Victims Across Multiple Countries gbhackers.com/safepay-rans...
SafePay Ransomware Strikes 260+ Victims Across Multiple Countries
The SafePay ransomware organization has quickly become a powerful operator since its initial detection in September 2024.
gbhackers.com
August 3, 2025 at 11:30 AM
SafePay Ransomware Strikes 260+ Victims Across Multiple Countries gbhackers.com/safepay-rans...
SafePay ransomware gang claims Microlise attack that disrupted prison van tracking
SafePay ransomware gang claims Microlise attack that disrupted prison van tracking
Fledgling band of crooks says it stole 1.2 TB of data
The new SafePay ransomware gang has claimed responsibility for the attack on UK telematics biz Microlise, giving the company less than 24 hours to pay its extortion demands before leaking data.…
dlvr.it
November 22, 2024 at 8:39 AM
SafePay ransomware gang claims Microlise attack that disrupted prison van tracking
If you look at our reporting since June, the top 5 are roughly:
1. Qilin
2. Akira
3. Play
4. INC
5. Safepay
1. Qilin
2. Akira
3. Play
4. INC
5. Safepay
November 14, 2025 at 6:21 PM
If you look at our reporting since June, the top 5 are roughly:
1. Qilin
2. Akira
3. Play
4. INC
5. Safepay
1. Qilin
2. Akira
3. Play
4. INC
5. Safepay
Ingram Micro confirms ransomware behind multi-day outage
Ingram Micro confirms ransomware behind multi-day outage
SafePay crew claims responsibility for intrusion at one of world's largest tech distributors
Ingram Micro, one of the world’s largest distributors, has confirmed it is trying to restore systems following a ransomware attack.…
dlvr.it
July 6, 2025 at 1:16 PM
Ingram Micro confirms ransomware behind multi-day outage
🚨SAFEPAY Ransomware Names 13 New Victims
June 14, 2025 at 3:28 PM
🚨SAFEPAY Ransomware Names 13 New Victims
Ingram Micro has begun restoring systems and business services after suffering a massive SafePay ransomware attack right before the July 4th holiday.
Ingram Micro starts restoring systems after ransomware attack
Ingram Micro has begun restoring systems and business services after suffering a massive SafePay ransomware attack right before the July 4th holiday.
www.bleepingcomputer.com
July 9, 2025 at 3:14 PM
Ingram Micro has begun restoring systems and business services after suffering a massive SafePay ransomware attack right before the July 4th holiday.
Aussie passports compromised in alleged Favelle Favco data breach www.cyberdaily.au/security/134...
Exclusive: Aussie passports compromised in alleged Favelle Favco data breach
Employee identity documents and Melbourne crane collapse data were posted to the dark web by SafePay ransomware gang.
www.cyberdaily.au
April 23, 2026 at 2:42 AM
Aussie passports compromised in alleged Favelle Favco data breach www.cyberdaily.au/security/134...
🚨 nuova rivendicazione #ransomware Italia 🚨
🏴☠️ gruppo #Safepay
🧬 SEI NordOvest S.R.L. | Milano
🎯 settore: G - Commercio
🔗 seinordovest.it
🗓️ 19 giugno 2026
📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 21 giugno 2026
#ransomNews #cyberthreats
🏴☠️ gruppo #Safepay
🧬 SEI NordOvest S.R.L. | Milano
🎯 settore: G - Commercio
🔗 seinordovest.it
🗓️ 19 giugno 2026
📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 21 giugno 2026
#ransomNews #cyberthreats
June 20, 2026 at 1:43 PM
🚨 nuova rivendicazione #ransomware Italia 🚨
🏴☠️ gruppo #Safepay
🧬 SEI NordOvest S.R.L. | Milano
🎯 settore: G - Commercio
🔗 seinordovest.it
🗓️ 19 giugno 2026
📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 21 giugno 2026
#ransomNews #cyberthreats
🏴☠️ gruppo #Safepay
🧬 SEI NordOvest S.R.L. | Milano
🎯 settore: G - Commercio
🔗 seinordovest.it
🗓️ 19 giugno 2026
📄 sample: -
▪️ dati esfiltrati dichiarati: -
▪️ dati esfiltrati pubblicati: -
⏲️ scadenza: 21 giugno 2026
#ransomNews #cyberthreats
New claim on the shame-site for #ransomware / #datatheft group #SAFEPAY.
Organization: Triniti Home Health & Hospice
Location: #UnitedStates
Industry: #HospitalsAndHealthCare
Staff: 51-200 employees
Learn more: https://ecrime.ch/
Organization: Triniti Home Health & Hospice
Location: #UnitedStates
Industry: #HospitalsAndHealthCare
Staff: 51-200 employees
Learn more: https://ecrime.ch/
September 16, 2026 at 5:05 AM
New claim on the shame-site for #ransomware / #datatheft group #SAFEPAY.
Organization: Triniti Home Health & Hospice
Location: #UnitedStates
Industry: #HospitalsAndHealthCare
Staff: 51-200 employees
Learn more: https://ecrime.ch/
Organization: Triniti Home Health & Hospice
Location: #UnitedStates
Industry: #HospitalsAndHealthCare
Staff: 51-200 employees
Learn more: https://ecrime.ch/
Ransomware-Angriff: Druckdienstleister #Ransomware #Einbruch #infosec #TeamInfoSec #cyberangriff
Ransomware-Angriff: Druckdienstleister
Ransomware: Safepay setzt Frist von drei Tagen.
www.security-incidents.de
September 21, 2026 at 7:35 AM
Ransomware-Angriff: Druckdienstleister #Ransomware #Einbruch #infosec #TeamInfoSec #cyberangriff