Actor Profile

SafePay is a private ransomware operation that emerged in August 2024, operating without an affiliate model. The group has rapidly become one of the most active ransomware operations globally, targeting critical infrastructure organizations across North America, South America, Europe, and Australia. SafePay employs double-extortion tactics, exfiltrating sensitive data before encryption and threatening public disclosure if ransom demands are not met. The group has compromised at least 600 organizations from multiple critical infrastructure sectors since August 2024, filling the operational gap left by dismantled groups like BlackCat (ALPHV) and LockBit since early 2025.

TTPs (Tactics, Techniques, Procedures)

SafePay actors gain initial access through multiple vectors: credential exposure, brute force password attacks, exploitation of VPN access (particularly targeting Mullvad VPN IP addresses), phishing for account credentials, and exploitation of CVEs affecting edge devices and internet-exposed systems via automated scripts. Post-compromise, the group performs lateral movement using administrative tools, deploys ransomware for encryption, and disrupts recovery operations by deleting shadow copies and resetting network-attached storage (NAS) devices containing backups. The operation follows a double-extortion model, exfiltrating sensitive documents prior to encryption. Key MITRE ATT&CK techniques include: T1110 (Brute Force), T1078 (Valid Accounts), T1566 (Phishing), T1190 (Exploit Public-Facing Application), T1021 (Remote Services), T1490 (Inhibit System Recovery), T1486 (Data Encrypted for Impact), and T1567 (Exfiltration Over Web Service).

Targets & Patterns

SafePay specifically targets critical infrastructure organizations across multiple sectors worldwide. The group has demonstrated global reach with victims spanning North America, South America, Europe, and Australia. With over 600 confirmed victims since August 2024, the actual victim count is likely higher, as SafePay only lists non-paying victims on its dark web leak site. The focus on critical infrastructure sectors suggests the group seeks high-value targets with significant operational dependencies and pressure to restore services quickly, increasing the likelihood of ransom payment. The targeting pattern indicates opportunistic exploitation of vulnerable edge devices and VPN infrastructure rather than sector-specific tailoring, though the impact on essential services amplifies the threat severity.

Historical Context

SafePay emerged in August 2024 as a private ransomware operation, distinguishing itself from the prevalent ransomware-as-a-service (RaaS) model by operating without affiliates. Since early 2025, the group has filled the operational vacuum left by the disruption of major ransomware operations BlackCat (ALPHV) and LockBit, becoming one of the most active ransomware groups globally. The joint advisory from CISA, FBI, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, and the UK's National Crime Agency reflects observed activity between November 2024 and August 2026, indicating sustained and escalating operations over a two-year period. The group's rapid ascent and consistent activity pattern demonstrate adaptability and operational maturity uncommon for newly emerged ransomware operations.

Defensive Recommendations

  • Implement multifactor authentication (MFA) across all remote access points, particularly VPN infrastructure, and enforce identity, credential, and access management (ICAM) policies to mitigate credential-based initial access (T1078, T1110)
  • Prioritize patching of CVEs affecting VPNs, firewalls, and edge devices listed in CISA's Known Exploited Vulnerabilities catalog, as SafePay actively exploits these for initial access via automated scripts (T1190)
  • Restrict administrative tools and privileges using least-privilege principles and network segmentation to limit lateral movement post-compromise (T1021)
  • Implement immutable backup solutions with offline or air-gapped storage to protect against backup deletion and NAS reset tactics, and regularly test restoration procedures (T1490)
  • Monitor for suspicious activity associated with Mullvad VPN IP addresses and deploy behavioral analytics to detect brute force attempts, unusual authentication patterns, and shadow copy deletion (T1110, T1490, T1078)
  • Report ransomware incidents to CISA, FBI, and local law enforcement immediately, as paying ransoms does not guarantee file recovery and funds criminal operations

---

# Geopolitical Context

Geopolitical Context

The SafePay ransomware campaign represents a significant escalation in threats to critical infrastructure across multiple continents. Operating as a private, non-affiliate model since August 2024, SafePay has systematically targeted essential services in North America, South America, Europe, and Australia. The group's focus on critical infrastructure sectors—combined with sophisticated initial access techniques including VPN exploitation (notably Mullvad IP addresses), credential compromise, and automated CVE exploitation—demonstrates a capability set that poses strategic risks to national security and economic stability. The joint advisory from U.S. agencies (CISA, FBI, USSS), German law enforcement (Landeskriminalamt Rheinland-Pfalz), and UK authorities (NCA, North West ROCU) reflects the transnational nature of the threat and the coordinated international response required. SafePay's emergence appears to coincide with disruptions to BlackCat (ALPHV) and LockBit operations, suggesting a reshaping of the ransomware ecosystem in which new actors rapidly fill operational voids left by law enforcement actions against established groups.

State Actor Alignment

The advisory does not attribute SafePay to any state actor or indicate state sponsorship. The group operates as a private criminal enterprise using double-extortion tactics for financial gain. However, the systematic targeting of critical infrastructure across Western democracies and allied nations raises questions about potential strategic tolerance or safe harbor. The involvement of German and UK law enforcement alongside U.S. agencies in the investigation suggests the threat is being treated as a transnational organized crime matter rather than state-sponsored activity. No sanctions designations or formal attribution to nation-state actors are mentioned in the reporting. The group's operational security measures—including use of privacy-focused VPN services like Mullvad—indicate sophisticated tradecraft but do not necessarily imply state backing.

Business Impacty pro region

The geographic distribution of SafePay victims across four continents indicates a global threat with particular concentration in developed economies with mature digital infrastructure. For Europe, the involvement of German and UK law enforcement signals that the region faces substantial exposure, likely due to high-value targets in manufacturing, energy, and transportation sectors. North American critical infrastructure remains a primary target, consistent with broader ransomware trends targeting healthcare, energy, and municipal services. The inclusion of Australian victims extends the threat to the Indo-Pacific region, potentially impacting supply chains and allied coordination. The advisory's emphasis on VPN and edge device vulnerabilities suggests that organizations with distributed operations and remote access requirements face elevated risk. The transnational law enforcement response—spanning U.S., German, and UK agencies—demonstrates growing operational coordination among Western allies in countering cyber threats, though the continued success of SafePay indicates persistent gaps in collective defense capabilities.

Forecast

If SafePay continues to operate without significant law enforcement disruption, the group is likely to maintain or increase its operational tempo, particularly if it successfully consolidates market share vacated by disrupted ransomware operations like LockBit and BlackCat. Organizations that fail to implement the recommended mitigations—particularly MFA, ICAM policies, and timely patching of edge devices—will remain vulnerable to compromise. If international law enforcement agencies successfully identify SafePay infrastructure or operators, coordinated takedown operations similar to those against LockBit may be attempted, though the group's operational security measures may complicate attribution and disruption efforts. The advisory's emphasis on not paying ransoms may reduce attacker revenue over time if widely adopted, potentially forcing operational changes or targeting shifts. However, if critical infrastructure organizations continue to pay ransoms to restore operations quickly, SafePay's financial incentives will remain strong. The involvement of multiple national agencies suggests that intelligence sharing and joint investigations will likely intensify, potentially leading to arrests or infrastructure seizures in the coming months to years, depending on the group's geographic location and operational security posture.