SafePay
Unknown Active
- Mentions
- 3
- First seen
- 20 Oct 2026
- Last seen
- 21 Oct 2026
Relevant to you · Affects your stack
- Technology:
- Microsoft Active Directory
- Threat focus:
- ransomware
Origin
Unattributed
Profile
SafePay is a ransomware gang that according to CISA has hit over 600 critical infrastructure organizations. The FBI describes the SafePay ransomware group as among the most active, with more than 600 victims since 2024. The reporting comes from a joint CISA and FBI advisory under the #StopRansomware initiative.
Targeted sectors
critical infrastructure
Associated malware / tools
SafePay ransomware