ZeroHour

safepay

ransomware group · aka SafePay · unknown (no widely accepted country attribution in public reporting) · active since 2021-07

Victims · 7d
10flat
Victims · 30d
22active targets
Victims · 90d
67
All-time (tracked)
573since 2024-11-20
Last post
09-15 21:35UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

SafePay is a ransomware and data-extortion group first observed in mid-2021, known for a double-extortion model in which it encrypts victim systems and threatens to publish stolen data on its Tor-based leak site. Early vendor research described initial access through exposed remote-access services such as VPN and RDP, as well as SQL injection, though no specific CVEs are consistently attributed in public reporting. The group has primarily targeted small and mid-sized organizations across Europe and North America, reportedly avoiding CIS-region victims and high-profile targets. Attribution, country of origin, and the group's affiliate structure are not documented in detail in public sources. This dashboard recorded 10 leak-site posts in the 7 days ending 2026-09-09, indicating continued activity.

Tactics & tooling
  • Double extortion: encrypts systems and threatens publication of exfiltrated data on a Tor leak site
  • Initial access via exposed VPN/remote-access infrastructure and RDP (early vendor reporting)
  • SQL-injection-based access described in 2021 vendor research
  • Data exfiltration prior to encryption, reportedly using legitimate file-transfer/exfiltration utilities
  • Per-victim negotiation rather than standardized public ransom demands
  • Targets predominantly small and mid-sized businesses with no single sector focus
  • Maintains a low public profile with limited dedicated malware analysis
Targeted sectors
manufacturinghealthcareprofessional and IT servicesnonprofitagri-food
Notable public victims

Recovery Cafe (US nonprofit; SafePay leak site, Sep 2026, per dashboard tracking), McNish Steel (US steel manufacturer; SafePay leak site, Sep 2026, per dashboard tracking), Palmetto Eye Institute (US healthcare provider; SafePay leak site, Sep 2026, per dashboard tracking), Gaya Fores (Spanish agri-food company; SafePay leak site, Sep 2026, per dashboard tracking), Reichenau (Austria; reichenau.at; SafePay leak site, Sep 2026, per dashboard tracking)

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
briar-group.com · Jul 26, 2025
teamsignal.com · Jul 26, 2025
tele-optics.com · Jul 26, 2025
appsnw.com · Jul 26, 2025
wta-inc.com · Jul 26, 2025
blueridgesl.com · Jul 22, 2025
rhschool.org · Jul 22, 2025
qtmi.net · Jul 22, 2025
horanbarker.com · Jul 22, 2025
naxis.net · Jul 22, 2025
landwwilson.co.uk · Jul 22, 2025
salemma.com.py · Jul 22, 2025
stichtingjohannesbosco.com · Jul 22, 2025
bisa.com.pe · Jul 22, 2025
norpak.com · Jul 18, 2025
ashland.k12.ma.us · Jul 17, 2025
divgroup.eu · Jul 17, 2025
hlb.ie · Jul 17, 2025
palmasdelixcan.com · Jul 17, 2025
accademia.it · Jul 17, 2025
nod.ro · Jul 12, 2025
bartec.com · Jul 12, 2025
silverdalebc.com · Jul 7, 2025
chirurgiemaxillo.com · Jul 7, 2025
lowcostspayneuterindiana.org · Jul 7, 2025
avgouleaschool.gr · Jul 7, 2025
lewis-manning.org.uk · Jul 7, 2025
wmat.nsn.us · Jul 7, 2025
cascobay.org · Jul 7, 2025
profile-ind.com · Jul 7, 2025
relucent.com · Jul 7, 2025
fmsarchitects.com · Jul 7, 2025
ppa-eng.com.org · Jul 7, 2025
caredig.co.uk · Jul 7, 2025
dossenterprises.com · Jul 1, 2025
lafayettefamilyymca.org · Jul 1, 2025
jansen-aschendorf.de · Jul 1, 2025
tdunhamcpa.com · Jun 25, 2025
mccn.org · Jun 23, 2025
mlderm.com · Jun 23, 2025
membersourcecu.org · Jun 17, 2025
macedonia.oh.us · Jun 17, 2025
codesco.com · Jun 14, 2025
packagesteel.com · Jun 14, 2025
hohmannoilandplumbing.com · Jun 14, 2025
cs-groupllc.com · Jun 14, 2025
pzsarchitects.com · Jun 14, 2025
welcometosedgebrook.com · Jun 14, 2025
moffett-towers-club.com · Jun 14, 2025
liberty-township.com · Jun 14, 2025

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .