Loading threat actor…
Unsafe is a ransomware-as-a-service group that uses double extortion, combining system encryption with threats to publish stolen data. It first appeared in December 2022, was relatively dormant during 2024 and 2025, and resumed activity in 2026. Its targeting includes organizations in the United States, Germany, Brazil, India, Switzerland, Finland, and France, spanning technology, business services, manufacturing, financial services, and healthcare. Unsafe maintains a dark-web leak site where it names victims and publishes purported stolen information. It listed Deutsche Bank and released database extracts containing employee information and internal records, although the claimed compromise and its full scope were not independently confirmed. Its operational behaviors include data exfiltration, disabling security controls, and removing traces of activity from compromised systems. No distinct aliases beyond capitalization variants or named subgroups are established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
1 indicator attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.