Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareRansomware

SafePay

SafePay is a ransomware operation that emerged in late 2024, first observed around September-October 2024. Multiple sources in the content describe it as a private, centralized, closed operation rather than a ransomware-as-a-service program; the group itself states on its leak site that it has never provided RaaS. SafePay uses double extortion, stealing data before encrypting systems and pressuring victims through a Tor-based leak site, with reporting noting that listed victims are generally those that did not pay. It has been described as one of the most active ransomware groups in 2025 and early 2026, with hundreds of claimed victims, including reporting of more than 260 and later more than 450 victims on its leak site.

Behaviorally, SafePay attacks are described as fast-moving, often progressing from initial access to encryption within 24 hours. Reported initial access vectors include compromised credentials on VPN gateways and RDP servers, and misconfigured FortiGate firewalls lacking MFA. Persistence and remote access have involved QDoor and ScreenConnect. Discovery and lateral movement have used ShareFinder.ps1, PsExec, WinRM, administrative utilities, and LOLBins. Defense evasion and impact behaviors include terminating antivirus, database, and backup processes, deleting Volume Shadow Copies, and modifying boot configuration to inhibit recovery. The ransomware is described as a Windows PE32 DLL that requires specific command-line arguments including a mandatory 32-byte password. Encryption reportedly uses AES or ChaCha20 for file encryption with keys protected by RSA or x25519, employs intermittent/block encryption for speed, appends the .safepay extension, and appends metadata containing an encrypted key and validation hash. Data theft has been conducted with WinRAR, FileZilla, Rclone, and 7-Zip. A kill switch prevents execution on systems with Cyrillic keyboard layouts, including Russian, Ukrainian, or Belarusian layouts.

SafePay has targeted organizations across multiple countries including Australia, the United States, the United Kingdom, Italy, New Zealand, Canada, Belgium, Brazil, Germany, Barbados, and Argentina. The content specifically highlights targeting of managed service providers and small-to-midsize businesses, and repeated activity against healthcare. Healthcare-focused reporting identifies SafePay among the most prolific ransomware strains targeting healthcare providers in 2025, and Health-ISAC describes SAFEPAY as focused on financial disruption, targeting healthcare billing and revenue-cycle systems and threatening exposure of billing records and patient financial data.

Victims and incidents directly mentioned in the content include Conduent, Ingram Micro, Favelle Favco, Genealogy SA, and Smile Team Orthodontics. In the Conduent intrusion from January 2025, SafePay claimed to have stolen more than 8 TB of data; Conduent confirmed that data from over 25 million individuals was stolen, including names, Social Security numbers, and medical or health insurance information, and the incident caused government service outages. In the July 2025 Ingram Micro incident, SafePay was reported as the responsible group, later claimed the attack on its leak site, and alleged theft of 3.5 TB of documents; Ingram Micro disclosed that more than 42,000 individuals were affected and that stolen files included employment and applicant records with names, contact information, dates of birth, Social Security numbers, driver’s license numbers, passport numbers, and employment-related evaluations. SafePay also listed Favelle Favco and Genealogy SA on its leak site and published data it claimed to have stolen from them, including business, financial, insurance, correspondence, technical, maintenance, and identity-document data.

Across the reporting in the content, SafePay is consistently characterized as a significant ransomware threat with strong operational security, centralized control of infrastructure and negotiations, and sustained activity through 2025 into 2026.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1078.002Domain AccountsEvidence1

T1078.002 - Valid Accounts: Domain Accounts. The Threat Actor was able to gain access to a local account through a simple misconfiguration of the firewall. Once inside, the Threat Actor was able to escalate to a domain administrator account not covered by MFA at the time of the attack.

T1190Exploit Public-Facing ApplicationEvidence1

T1190 - Exploit Public-Facing Application. A misconfiguration of a policy in the Fortigate firewall allowed local & LDAP groups to authenticate against the VPN, therefore bypassing the multi-factor authentication requirement.

Execution

1 technique
T1059.003Windows Command ShellEvidence1

T1059.003 – Command and Scripting Interpreter: Windows Command Shell. The compromised domain administrator account executed the batch file C:\ProgramData\<single digit>.bat.

Persistence

1 technique
T1078.002Domain AccountsEvidence1

T1078.002 - Valid Accounts: Domain Accounts. The Threat Actor was able to gain access to a local account through a simple misconfiguration of the firewall. Once inside, the Threat Actor was able to escalate to a domain administrator account not covered by MFA at the time of the attack.

Privilege Escalation

2 techniques
T1078.002Domain AccountsEvidence1

T1078.002 - Valid Accounts: Domain Accounts. The Threat Actor was able to gain access to a local account through a simple misconfiguration of the firewall. Once inside, the Threat Actor was able to escalate to a domain administrator account not covered by MFA at the time of the attack.

T1548.002Bypass User Account ControlEvidence1

By default, the malware performs a Windows UAC system bypass using a COM interface, with this flag, the malware confirms if the UAC was.

Stealth

1 technique
T1078.002Domain AccountsEvidence1

T1078.002 - Valid Accounts: Domain Accounts. The Threat Actor was able to gain access to a local account through a simple misconfiguration of the firewall. Once inside, the Threat Actor was able to escalate to a domain administrator account not covered by MFA at the time of the attack.

Discovery

2 techniques
T1082System Information DiscoveryEvidence1

T1082 – System Information Discovery. The batch files utilised by the Threat Actor, for example 1.bat, interacted with servers and file shares subsequently encrypting them using the ransomware binary 1.exe.

T1135Network Share DiscoveryEvidence1

T + ~7 hours – First malicious batch file utilised and network share discovery

Lateral Movement

1 technique
T1021.002SMB/Windows Admin SharesEvidence1

T1021.002 – Remote Services: SMB/Windows Admin Shares. The malicious batch files observed across the estate accessed drives and shares and pushed the ransomware binary 1.exe to numerous servers.

Impact

3 techniques
T1486Data Encrypted for ImpactEvidence3

On the ransomware front, attribution remains consistent, and the most prevalent ransomware brands we saw deployed mirror those most often seen by other threat intelligence sources. Akira ... and Qilin ... led the way, followed by SafePay, Inc, and Play.

T1490Inhibit System RecoveryEvidence1

Anti-Recovery Tactics: vssadmin delete shadows /all / quiet; wmic shadowcopy delete; bcdedit / set{default}recoveryenabled no

T1531Account Access RemovalEvidence1

T1531 – Account Access Removal. The threat actor changed all admin passwords making it difficult for the victim to access the infrastructure once encryption had occurred.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app1 month ago
ip.v4●●●●●●●●●●●●View more in app7 months ago
hash.sha1●●●●●●●●●●●●View more in app
domain●●●●●●●●●●●●View more in app
email●●●●●●●●●●●●View more in app
email●●●●●●●●●●●●View more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.