SafePay

SafePay is a privately operated ransomware family and associated extortion operation that emerged in late 2024 and rapidly became one of the more active ransomware threats observed in 2025 and early 2026. The operation publicly states that it is not a ransomware-as-a-service program, and reporting consistently characterizes it as a centralized, non-RaaS actor. SafePay uses a double-extortion model, stealing victim data before encrypting systems and threatening publication of stolen material to pressure payment.

SafePay has targeted organizations across multiple sectors and geographies, with repeated reporting of activity against healthcare providers, healthcare-related businesses, managed service providers, small and midsize businesses, and other enterprises. Victims have been reported in North America, Europe, and Australia, with Germany and the United States repeatedly identified among its principal target countries. Publicly attributed incidents include intrusions affecting healthcare entities, technology and distribution firms, industrial organizations, and government service providers.

Observed intrusion activity shows SafePay relying on conventional but effective operator-driven tradecraft rather than unusually advanced techniques. In at least one investigated case, initial access was obtained through password spraying against a VPN gateway, followed by a lengthy dwell period, privilege escalation to domain administrator, discovery of accessible shares, staging and compression of stolen data, exfiltration, and subsequent encryption. Operators have also searched for backup infrastructure and deleted shadow copies to hinder recovery. Reporting indicates SafePay has at times focused encryption activity inside guest virtual machines rather than directly encrypting hypervisors, suggesting stronger support for Windows environments than for native ESXi-level encryption in the observed period.

The SafePay encryptor is a custom Windows ransomware strain written in C. Reported technical characteristics include asynchronous file encryption using Overlapped I/O, configurable partial encryption, and use of AES-CBC when AES-NI is available or ChaCha20 otherwise, with Curve25519 protecting per-file key material. Analysts have noted design similarities to several established ransomware families but assessed the malware as likely independently developed rather than a direct derivative.

SafePay has been linked to major data theft and disruption events, including incidents involving healthcare-related organizations and large service providers where large volumes of personal, medical, financial, employment, and business data were reportedly stolen. Its activity profile, victim volume, and repeated use in high-impact extortion cases place it among the notable ransomware threats of the 2025–2026 period.