SafePay is a financially motivated ransomware group that first emerged in September 2024. Unlike most contemporary ransomware operations that utilize a Ransomware-as-a-Service (RaaS) model, SafePay operates as a centralized group, developing and deploying its own ransomware without affiliates. This operational model affords them tighter control and consistent tactics across incidents. The group is assessed with high confidence to be of Eastern European origin, evidenced by its ransomware terminating execution if it detects languages associated with former Soviet Union countries. SafePay employs a double extortion scheme, encrypting victim data and exfiltrating sensitive information, threatening to publish it on their dark web leak sites if ransoms are not paid. A unique characteristic of SafePay is its aggressive use of direct phone calls, or vishing, to victims to increase pressure and expedite ransom payments. They are also known for rapidly executing attacks, often moving from initi

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker