SafePayMalware
SafePay ransomware started in October 2024 as a new ransomware service, using some of the leaked LockBit source code. Soon after launching, the group made a big impact in the ransomware world, hacking at least 33 organizations by December 9. The first version of SafePay was created by modifying the LockBit source code.From MISP Galaxy
Last reported 2 days ago, by The Hacker News45 reports
ATT&CK techniques
6 of 41 · each with the sentence it comes from- T1110Brute Force
“…oducts (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766) or, alternatively, credential exposure and brute-force password attacks, for initial access, followed by persistence, privilege escalation, lateral movement, data exfiltration, and ransomwa…”
- T1021.001Remote Desktop Protocol
“They also employ remote desktop protocol (RDP) to expand their presence within the compromised network.”
- T1027.002Software Packing
“SafePay actors typically disable security software to avoid detection, and have also been observed using software packing or virtual machine software protection to conceal their code.”
- T1048Exfiltration Over Alternative Protocol
“… 7-Zip, RClone, and WinRAR to compress files and collect data [T1560.001], and WinSCP and RClone to facilitate the exfiltration of data [T1048] from the compromised network to actor-controlled accounts.”
- T1059Command and Scripting Interpreter
“…] that creates an elevated process through a specified component object model, enabling the execution of malicious commands or binaries [T1059].”
- T1059.001PowerShell
“…nction used for enumerating network file shares in Windows Active Directory environments—to identify valuable assets for exfiltration [T1059.001, T1059.003].”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
45 reports · the newest 20, newest first · the exact sentence from each-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More“SafePay Ransomware Claims More Than 600 Victims Since 2024”
-
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations“FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations”
-
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns“SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns”
-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“SafePay ransomware: US, German, and UK cyber agencies published a security advisory and technical report on the SafePay ransomware, a group that launched in October of 2024.”
-
FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024“FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024”
-
#StopRansomware: SafePay Ransomware“#StopRansomware: SafePay Ransomware”
-
Conduent Agrees to Pay $80m to Settle Data Breach Class Action“The attack on Conduent was allegedly perpetrated by the SafePay ransomware gang, which claimed it had stolen 8.5TB of data from the firm.”
-
safepay lists hiqbio.com“safepay lists hiqbio.com”
-
September 2026 Threat Trend Report on Ransomware“…wed by Akira with 47 incidents, Rhysidaarchive with 45, Metaencryptor with 40, KillSecurity with 37, KryBit with 34, IncRansom with 31, SafePay with 29, and DarkProject with 27.”
-
safepay lists hoteldelfinolugano.ch“safepay lists hoteldelfinolugano.ch”
-
safepay lists dwi-bau.de“safepay lists dwi-bau.de”
-
safepay lists dd-automation.ch“safepay lists dd-automation.ch”
-
safepay lists stuecheli.ch“safepay lists stuecheli.ch”
-
safepay lists bwi-bau.de“safepay lists bwi-bau.de”
-
safepay lists halservice.it“safepay lists halservice.it”
-
safepay lists grundens.com“safepay lists grundens.com”
-
safepay lists t-systems.com“safepay lists t-systems.com”
-
safepay lists duhaas.sk“safepay lists duhaas.sk”
-
safepay lists ikhasas.com“safepay lists ikhasas.com”
-
safepay lists sterrer.net“safepay lists sterrer.net”
Indicators in its reports
named in the reports above- 173.194.194[.]94in 1 report
- a0dc80a37eb7e271…ed228d9ff526in 1 report
- bbdd3620a67aedec…02a6f4bc6f41in 1 report
- infosec[.]exchangein 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.