SafePay
A double-extortion ransomware group active since August 2024 with at least 600 victims, according to an October 2026 advisory co-authored by the UK's National Crime Agency. Vendors describe it as a closed team with no affiliate programme.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The UK's law enforcement is directly involved. The NCA and the North West Regional Organised Crime Unit co-authored the advisory with US and German partners. It counts at least 600 victims across North America, South America, Europe and Australia.1 Bitdefender names Great Britain among the group's main victim countries.2
It attacks recovery. The advisory says it stops the Volume Shadow Copy Service, has reset backup NAS devices to factory settings, and in some cases deleted network-attached backups.1 It also uses phone calls to push victims into paying.1
It moves fast and appears to work without affiliates. Bitdefender says it is a closed operation, often going from access to encryption within 24 hours.2 The advisory does not state its model.1 Red Sense suggests links to former Conti members, and reports IT support impersonation through calls and Teams.3
Treat NAS and backup consoles as targets in their own right. Separate credentials for them, and keep one copy that a stolen domain account cannot reach.
How It Attacks
Based on the October 2026 joint advisory.1 Huntress adds early intrusion detail from October 2024.4
- 1
Get In
Uses exposed or guessed credentials, brute force, phished profiles, VPN access and automated scanning of exposed systems.
- 2
Hold On
Creates accounts, changes privileges and may change passwords to lock out real users. Uses AnyDesk, TeamViewer and ScreenConnect.
- 3
Discover and Harvest
Uses ShareFinder, SharpShares and NetExec, and Mimikatz for credentials.
- 4
Move
Uses PsExec, WinRM, RDP and RMM software.
- 5
Disable Defences
Bypasses UAC, impersonates tokens and disables security software, including Windows Defender.
- 6
Steal the Data
Compresses with 7-Zip or WinRAR, then moves it using Rclone, WinSCP, FileZilla, Backblaze B2 or OneDrive.
- 7
Encrypt and Pressure
Uses ChaCha20 with RSA, attacks backups, leaves a note pointing to a Tor chat, phones victims, and posts data if unpaid.
Key Techniques
From the ATT&CK mapping in the joint advisory, using v20 names.1
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1110 | Brute Force | Credential Access | Password guessing against exposed services. |
| T1133 | External Remote Services | Initial Access | VPN access. |
| T1190 | Exploit Public-Facing Application | Initial Access | Automated scripts against exposed systems. |
| T1548.002 | Bypass User Account Control | Privilege Escalation | UAC bypass. |
| T1685 | Disable or Modify Tools | Defense Impairment | Disables security software. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | RDP for movement. |
| T1560.001 | Archive via Utility | Collection | 7-Zip and WinRAR. |
| T1567 | Exfiltration Over Web Service | Exfiltration | Cloud storage. |
| T1490 | Inhibit System Recovery | Impact | Stops VSS and resets backup NAS devices. |
| T1486 | Data Encrypted for Impact | Impact | ChaCha20 with RSA. |
Tools Observed
Remote Access
Discovery and Credentials
Movement
Data Theft
From the joint advisory, which warns that many are legitimate and should not be treated as malicious without evidence of misuse.1
Vulnerabilities
All named in the joint advisory.1 Stolen and guessed credentials matter at least as much.
Akira's advisory names all five too.6 A shared flaw list does not show that the two groups are linked, but it does show where to patch first.
Key Events
Active from this month.1
Two intrusions later documented by Huntress, which finds the ransomware overlaps heavily with leaked LockBit code.4
NCC Group records the most monthly claims of any group.3
Bitdefender describes it as a closed, non-RaaS operation.2
Check Point reports a heavy focus on Germany.7
FBI, CISA, USSS, Germany's Landeskriminalamt Rheinland-Pfalz, the NCA and North West ROCU publish a joint advisory on 20 October.1
Warning Signs
Drawn from behaviours in the joint advisory.1 None proves an attack alone.
- New accounts or admin rights added without a change record
- User passwords changing and locking people out
- Scripts enumerating network shares
- Archives staged for transfer, then large uploads to cloud storage
- Remote desktop tools on systems where they are not expected
- The Volume Shadow Copy service stopped, or a NAS device reset
- Logins from commercial VPN ranges, especially after phishing
Defences That Matter
Fix Credentials First
- Require MFA, especially for VPNs, webmail and critical systems.1
- Use passwords of 15 to 64 characters, avoid reuse and enforce lockouts.1
- Check for unrecognised or inactive accounts.1
Patch and Reduce Exposure
- Patch known exploited vulnerabilities on internet-facing systems first.1
- Block untrusted origins from remote services and disable unused ports.1
Detect Early
- Monitor for abnormal activity and lateral movement, using EDR.1
- Restrict command-line and scripting activity where feasible.1
Protect Backups Separately
- Keep encrypted, immutable, offline backups and test them.1
- Separate NAS and backup admin credentials from the domain.
Would Your Backups Survive a Stolen Admin Account?
We can test your credentials, exposure and recovery against the methods in this profile, and then help you close the gaps.
Sources
- FBI, CISA, USSS, Landeskriminalamt Rheinland-Pfalz, NCA and North West ROCU: #StopRansomware: SafePay Ransomware, AA26-293A, 20 October 2026
- Bitdefender: SafePay Ransomware Attacks and TTPs, 4 September 2025
- Infosecurity Magazine: Unmasking the SafePay Ransomware Group, 10 July 2025
- Huntress: SafePay Ransomware: How It Works and How to Stop It, last updated 17 July 2026
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
- FBI, CISA and partners: #StopRansomware: Akira Ransomware, AA24-109A, updated 13 November 2025
- Check Point Research: The State of Ransomware Q2 2026, covering April to June 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.