Signalis
sign in--:--:--UTC
Threat actors

Safepay

Reports
34
First seen
Nov 14
Last seen
Jun 22
Motivation
extortion, financial, financial extortion

Targeting

Sectors
manufacturing ×5other ×3retail ecommerce ×2government ×2transportation logistics ×2technology ×1media entertainment ×1healthcare ×1
Victim regions
Germany ×9Italy ×3United States ×3Japan ×3United Kingdom ×3New Zealand ×1European Union ×1

Top ATT&CK techniques

T1566 Phishing ×1T1218.010 System Binary Proxy Execution: Regsvcs/Regasm ×1T1041 Exfiltration Over C2 Channel ×1T1560.001 Archive Collected Data: Archive via Utility ×1T1021.001 Remote Services: Remote Desktop Protocol ×1T1195 Supply Chain Compromise ×1T1190 Exploit Public-Facing Application ×1T1556 Modify Authentication Process ×1T1135 Network Share Discovery ×1T1110 Brute Force ×1T1486 Data Encrypted for Impact ×1T1490 Inhibit System Recovery ×1

Indicators

domain ×40filename ×15hash_md5 ×8ip_v4 ×6cve ×4hash_sha256 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-34926 (exploited)CVE-2026-41091 (exploited)CVE-2026-45498 (exploited)CVE-2026-9082 (exploited)

Recent reports

High

Safepay ransomware claims ehg.bayern as victim

ransomware.liveHigh

Safepay ransomware gang publishes seinordovest.it as victim

ransomware.liveHigh

Safepay ransomware group claims Harcourts real estate company as victim

ransomware.liveHigh

Safepay ransomware claims Zaunsysteme as victim

ransomware.liveHigh

Safepay ransomware claims brscappuccio.it as victim

ransomware.liveHigh

Safepay ransomware gang publishes gut-heckenhof.de as victim

ransomware.liveMedium

Safepay ransomware claims Hugh Stirling as victim

ransomware.liveHigh

Safepay ransomware claims Tokyo Civil Engineering victim

ransomware.liveHigh

Safepay ransomware publishes kawaius.com as victim

ransomware.liveHigh

Safepay claims victim: musenet.co.jp

ransomware.liveHigh

Safepay ransomware publishes Bautz Maschinenbau as victim

ransomware.liveHigh

Safepay ransomware gang publishes aquaclean.com as victim

ransomware.liveHigh

Safepay ransomware gang publishes Hood River Sheriff's Office as victim

ransomware.liveHigh

Safepay ransomware gang publishes iql-nog.com as victim

ransomware.liveHigh

Safepay ransomware gang claims tavolaspa.com victim

ransomware.liveHigh

Safepay ransomware targets Parsa Beauty, German hair and personal care distributor

ransomware.liveHigh

Safepay ransomware gang claims Italian victim soraris.it

ransomware.liveHigh

Safepay ransomware gang claims lcnet.eu victim

ransomware.liveHigh

Safepay ransomware claims Verzolla as victim

ransomware.liveHigh

Safepay ransomware publishes CompactMould as victim

ransomware.liveHigh

Safepay ransomware claims breach of eitecpro.co.jp

ransomware.liveHigh

Safepay ransomware claims tme-rusta.de as victim

ransomware.liveMedium

Safepay ransomware claims cyuou.com as victim

ransomware.liveHigh

Safepay claims VDM Trucking victim on ransomware.live leak site

ransomware.liveHigh

Check Point Threat Intelligence Report – 25 May 2026

Check Point ResearchHigh

Safepay ransomware gang claims olipes.com victim

ransomware.liveHigh

Safepay ransomware claims Harrison County, WV as victim

ransomware.liveHigh

Safepay ransomware gang claims Printroom.co.uk as victim

ransomware.liveHigh

Safepay ransomware gang claims dental practice victim in Germany

ransomware.liveHigh

Safepay ransomware gang publishes mediafrance.de as victim

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans