Safepay
Safepay is a ransomware group with a financial motive, tracked by Brandefense. It targets 17 sectors, including Government and Technology, in 51 countries, including the United States and the United Kingdom. It uses 75 MITRE ATT&CK techniques and exploits 18 known CVEs.
- SafePay Team
- Techniques
- 75
- Exploited CVEs
- 18
- First seen
- Nov 19, 2024
- Last seen
- Aug 25, 2026
- Record updated
Who They Target.
About Safepay.
SafePay emerged in September 2024 as a rapidly growing ransomware operation that explicitly disavows the RaaS model and manages all operations internally, claiming over 300 victims worldwide by mid-2025 with a high-profile early attack against UK telematics firm Microlise stealing 1.2 TB of data.
Last updated Sep 29, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.