SafePay Ransomware Hits 73 Organizations in Just One Month

SafePay, an emerging ransomware group, has risen rapidly in 2025, with its June 2025 attacks on 73 organizations topping Bitdefender Threat Debrief rankings for the month, and July adding 42 victims to its tally. To date this year the group claims more than 270 victims, and its operators eschew the ransomware‑as‑a‑service model, maintaining full control and keeping a closed data‑leak site that lists victims after encryption.

SafePay first appeared in September 2024, shortly after global law enforcement disrupted the ALPHV (BlackCat) operation and seized LockBit infrastructure during Operation Cronos, with forensic analysis noting code similarities to LockBit Black but a unique per‑file symmetric key approach plus a master key embedded in the ransomware. Unlike many competitors, SafePay does not advertise an affiliate program and does not rely on third‑party operators, allowing it to keep 100 percent of ransom payments.

Victims span mid‑size and enterprise organisations across the United States, Germany, Great Britain and Canada, in sectors including manufacturing, healthcare, construction, education, research, government and technology services, with encryption typically completed within 24 hours or less. Recovery notes given to victims include a unique decryption ID and a ten‑day window to pay in Bitcoin before data is publicly leaked. according to GBHackers.