SafePay
Independent, financially motivated ransomware group; no nation-state attribution reported. Operates a centralized model rather than a public RaaS/affiliate program. · Financial — double-extortion ransomware.
Tactics, Techniques & Procedures (TTPs)
- Per AA26-293A: exploits Cisco ASA/FTD, Veeam Backup & Replication and SonicWall SonicOS flaws (some via automated scripts), plus brute force and Mullvad VPN access
- Per AA26-293A: lateral movement with PsExec, WinRM, RDP, AnyDesk and TeamViewer; ShareFinder.ps1 and SharpShares.exe for share discovery; RClone, WinSCP and FileZilla for exfiltration
- Initial access via internet-facing RDP and VPN infrastructure, typically using valid but compromised credentials rather than novel exploits (e.g., GlobalProtect VPN in the Ingram Micro intrusion)
- Very fast attack chains — full compromise to encryption in under 24 hours in documented cases
- Disables endpoint protection, deletes volume shadow copies, and clears event logs before encryption
- Double extortion using a hybrid AES/RSA encryption scheme; Acronis estimates ~111GB of data exfiltrated per victim on average
- Encryptor shows substantial code overlap with the leaked LockBit 3.0 ('LockBit Black') builder, plus elements echoing ALPHV/BlackCat and INC Ransom tooling
Known Targets
Analyst Notes
October 20, 2026: CISA, FBI, US Secret Service, the German LKA Rheinland-Pfalz and the UK NCA published joint #StopRansomware advisory AA26-293A, reporting at least 600 victims across North America, South America, Europe and Australia since August 2024 and naming five exploited flaws: CVE-2020-3259 and CVE-2023-20269 (Cisco ASA/FTD), CVE-2023-27532 and CVE-2024-40711 (Veeam Backup & Replication), CVE-2024-40766 (SonicWall SonicOS). The advisory also reports resets of backup NAS devices to factory settings and a ChaCha20/RSA hybrid encryption scheme, and ships STIX IOCs. By early August 2026, SafePay's leak site listed 537 total claimed victims (27 in the preceding 30 days), making it the most active tracked ransomware group as of mid-2026 — overtaking established names like Qilin and RansomHub by volume. Targets opportunistically by exploitable exposure rather than by sector, with deliberate emphasis on MSPs as force multipliers into downstream client environments.
Intelligence Reports
CISA, FBI and UK NCA Issue Joint #StopRansomware Advisory on SafePay, Citing 600+ Victims
A joint advisory from US, German and UK agencies details SafePay's initial access, tooling and exfiltration methods, and lists five edge-device and backup vulnerabilities the group exploits.
SafePay: How a LockBit Code Derivative Became 2026's Most Active Ransomware Group
SafePay went from an obscure late-2024 leak site to the most active ransomware operation tracked in 2026, built on leaked LockBit code, a centralized non-affiliate model, and a deliberate focus on MSPs and their downstream clients.