Loading threat actor…
SafePay, also known as the SafePay ransomware group, SafePay ransomware gang and SafePay Team, is a financially motivated cybercriminal group conducting ransomware and extortion operations against organizations across multiple countries. Its targeting spans healthcare and biotechnology, information technology, construction and engineering, professional services, manufacturing, retail, hospitality, agriculture and municipal government. Germany and the United States feature prominently among its reported targets, alongside organizations elsewhere in Europe and other regions. SafePay uses a dedicated data-leak site to publish victim claims as part of its extortion activity. Its operations have also been associated with data theft, including sensitive personal, health insurance and medical information. Its country of origin and organizational structure are not established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
25 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware group alleged to have stolen approximately 8.5 terabytes of data from Conduent in a breach affecting 62.2 million people. The stolen information included personal identifiers, health insurance details and medical information. The article also links SafePay to a January 2025 attack against North Carolina's Marlboro-Chesterfield Pathology practice.
Reportedly conducted a ransomware attack against US-based hiqbio.com, a marine biotechnology company serving human health, animal health, functional foods, and sustainable aquaculture. The report lists both the breach and discovery time as October 12, 2026, at 20:25 UTC.
SafePay lists hiqbio.com, a US company applying marine biotechnology to health, functional foods, and sustainable aquaculture, as a victim discovered on October 12, 2026. The post provides no stolen-data volume, samples, ransom demand, or deadline.
Reportedly conducted a ransomware attack against dwi-bau.de, a German company specializing in building systems for metal roofs and facades. The incident was discovered on October 9, 2026, at 22:09 UTC. The report provides no technical details about the intrusion or ransomware deployed.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.