Signalis
sign in--:--:--UTC
Threat actors

Safepay

☆ pin
Also known as SafePay
Reports
116
First seen
Nov 14, 2024
Last seen
Oct 12, 2026
Motivation
Financial

Targeting

Sectors
Manufacturing ×14Other ×12Professional Services ×5Retail & E-commerce ×5Education ×4Technology ×4Healthcare ×4Transport & Logistics ×3
Victim regions
×2
×34
Germany×34
United States×13
Italy×7
United Kingdom×5
Japan×4
Switzerland×4
Spain×3
European Union×2

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×1T1041 Exfiltration Over C2 Channel ×1T1021.001 Remote Services: Remote Desktop Protocol ×1T1195 Supply Chain Compromise ×1T1135 Network Share Discovery ×1T1486 Data Encrypted for Impact ×1T1059.001 Command and Scripting Interpreter: PowerShell ×1T1078 Valid Accounts ×1T1021 Remote Services ×1T1059 Command and Scripting Interpreter ×1T1562.001 Impair Defenses: Disable or Modify Tools ×1T1218.010 System Binary Proxy Execution: Regsvcs/Regasm ×1

Indicators

domain ×157ip_v4 ×37filename ×15hash_md5 ×11hash_sha1 ×9hash_sha256 ×6cve ×4

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-34926 (exploited)CVE-2026-41091 (exploited)CVE-2026-45498 (exploited)CVE-2026-9082 (exploited)

Recent reports

High

Safepay ransomware gang claims breach of hiqbio.com

ransomware.liveHigh

Safepay ransomware claims Hotel Delfino Lugano as victim

ransomware.liveHigh

Safepay ransomware publishes dwi-bau.de as victim

ransomware.liveHigh

Safepay ransomware claims dd-automation.ch as victim

ransomware.liveHigh

Safepay ransomware publishes stuecheli.ch as victim

ransomware.liveHigh

Safepay ransomware gang publishes bwi-bau.de as victim

ransomware.liveMedium

Safepay ransomware gang claims halservice.it as new victim

ransomware.liveHigh

Safepay claims victim: Grundens (grundens.com)

ransomware.liveHigh

Safepay ransomware gang claims T-Systems as victim

ransomware.liveMedium

Safepay ransomware publishes anwo.cl as victim

ransomware.liveHigh

Safepay ransomware claims victim: duhaas.sk

ransomware.liveHigh

Safepay ransomware claims victim ikhasas.com

ransomware.liveHigh

Safepay ransomware claims sterrer.net victim

ransomware.liveHigh

Safepay ransomware claims wolfusofsky.de as victim

ransomware.liveHigh

Safepay ransomware claims econ-tec.com as victim

ransomware.liveHigh

Safepay ransomware gang publishes assist2enjoy.be as victim

ransomware.liveHigh

Safepay ransomware gang publishes manno.ch as victim

ransomware.liveMedium

Safepay ransomware publishes auromex.com victim

ransomware.liveHigh

Safepay ransomware gang claims cromados.com victim

ransomware.liveHigh

Safepay ransomware publishes lfgholding.com as victim

ransomware.liveHigh

Safepay claims Fe del Mundo Children's Memorial Hospital in Philippines

ransomware.liveHigh

Safepay ransomware publishes Bio-Strath as victim

ransomware.liveHigh

Safepay ransomware gang claims Šumperk city portal (sumperk.cz) as victim

ransomware.liveMedium

Safepay ransomware gang claims eagroep.com victim

ransomware.liveHigh

Safepay ransomware gang publishes Holiday Inn Vilnius as victim

ransomware.liveHigh

Safepay ransomware claims Compunnel as victim

ransomware.liveHigh

Safepay ransomware publishes Palmetto Eye Institute as victim

ransomware.liveMedium

Safepay ransomware group publishes reichenau.at as victim

ransomware.liveMedium

Safepay ransomware claims cannonpuntana.com as victim

ransomware.liveHigh

Safepay ransomware publishes Assiprime as victim on ransomware.live

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans