Signalis
sign in--:--:--UTC
Threat actors

Safepay

☆ pin
Also known as SafePay
Reports
78
First seen
Nov 14, 2024
Last seen
Aug 14, 2026
Motivation
Financial

Targeting

Sectors
Other ×9Manufacturing ×9Education ×4Professional Services ×4Retail & E-commerce ×4Transport & Logistics ×3Technology ×2Healthcare ×2
Victim regions
×1
×30
Germany×30
United States×9
United Kingdom×5
Italy×4
Japan×4
European Union×2
France×1
Australia×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×1T1041 Exfiltration Over C2 Channel ×1T1021.001 Remote Services: Remote Desktop Protocol ×1T1195 Supply Chain Compromise ×1T1135 Network Share Discovery ×1T1486 Data Encrypted for Impact ×1T1059.001 Command and Scripting Interpreter: PowerShell ×1T1078 Valid Accounts ×1T1021 Remote Services ×1T1059 Command and Scripting Interpreter ×1T1562.001 Impair Defenses: Disable or Modify Tools ×1T1218.010 System Binary Proxy Execution: Regsvcs/Regasm ×1

Indicators

domain ×96ip_v4 ×19filename ×15hash_md5 ×10cve ×4hash_sha1 ×3hash_sha256 ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-34926 (exploited)CVE-2026-41091 (exploited)CVE-2026-45498 (exploited)CVE-2026-9082 (exploited)

Recent reports

Medium

Safepay ransomware claims granjarinya.com as victim

ransomware.liveHigh

Safepay ransomware gang claims pradotuylaw.com victim

ransomware.liveHigh

Safepay ransomware gang claims Nask Door Inc. as victim

ransomware.liveHigh

Safepay ransomware claims new-point.it as victim

ransomware.liveHigh

Safepay ransomware claims Simonrack, Spanish metal shelving manufacturer

ransomware.liveHigh

Safepay ransomware claims Hanan Hov as new victim

ransomware.liveHigh

Safepay ransomware claims Japanese victim azn.co.jp

ransomware.liveHigh

Safepay ransomware targets South Shore Recycling

ransomware.liveHigh

Safepay ransomware gang claims cpu-ag.com victim

ransomware.liveHigh

Safepay ransomware claims multiaqua.com as victim

ransomware.liveHigh

Safepay ransomware gang claims Zinorm.de victim

ransomware.liveHigh

Safepay ransomware targets moebelmayer.de

ransomware.liveHigh

Safepay ransomware group claims Paritaet NRW as victim

ransomware.liveMedium

Safepay ransomware claims haugbuersten.de as victim

ransomware.liveHigh

Safepay ransomware gang claims Landesmuseum breach

ransomware.liveHigh

Safepay ransomware gang publishes HST.eu as victim

ransomware.liveHigh

Safepay ransomware claims Braywood School

ransomware.liveHigh

Safepay ransomware gang claims weier.org as victim

ransomware.liveMedium

Safepay ransomware claims BNP Dist as victim

ransomware.liveHigh

Safepay ransomware claims Upland School District (California)

ransomware.liveHigh

Safepay publishes GV Surgical Arts as new victim

ransomware.liveMedium

Safepay ransomware gang claims attack on wdk.de

ransomware.liveHigh

Safepay ransomware publishes Jaecklin Industrial as victim

ransomware.liveHigh

Safepay ransomware publishes LBB Treuhand as victim

ransomware.liveHigh

Safepay ransomware claims new victim: timetex.de

ransomware.liveHigh

Safepay ransomware gang publishes Stroebel Gruppe as victim

ransomware.liveMedium

Safepay ransomware gang claims industriesjaro.com victim

ransomware.liveHigh

Safepay ransomware gang claims cenesco.de as new victim

ransomware.liveHigh

Safepay ransomware claims ACS Maxwell as victim

ransomware.liveHigh

Safepay ransomware publishes mende-grundbesitz.de as victim

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans