Emerging Threat Actor: SafePay Ransomware

SafePay is a rapidly rising Ransomware-as-a-Service (RaaS) group active since November 2024 that employs double extortion—encrypting systems (appending ".safepay") and exfiltrating data to public leak sites on Tor and The Open Network (TON). The group shows technical maturity and operational discipline, reuses elements from leaked LockBit code, leverages known enterprise vulnerabilities and legitimate remote management tools for access and persistence, uses credential-stealing tools like Mimikatz during post-exploitation, and permits affiliates to conduct attacks under its name, targeting mid-to-large organizations across multiple industries.