SafePay
SafePay ransomware started in October 2024 as a new ransomware service, using some of the leaked LockBit source code. Soon after launching, the group made a big impact in the ransomware world, hacking at least 33 organizations by December 9. The first version of SafePay was created by modifying the LockBit source code. It adds the ".safepay" extension to files that it encrypts and includes a… Source: MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 20 Oct 2026 · last seen on 20 Oct 2026
News
- FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024The Record · 20 Oct 2026
MITRE ATT&CK techniques
Resource Development
Initial Access
Execution
Privilege Escalation
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact
Stealth
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy and SigmaHQ. malpedia.caad.fkie.fraunhofer.de ↗