Hunt / safepay
safepay
66victims, 90d
Nov 4last post
3reports about them
-techniques with a rule
0indicators
Who they hit
| Posted | Victim | Country |
|---|---|---|
| 2026-11-04 | prospecthillcamberwell.com.au | AU |
| 2026-11-04 | jhz-bernardshof.de | DE |
| 2026-11-04 | ehrenwall.de | DE |
| 2026-11-04 | ruscopackaging.com | US |
| 2026-11-04 | valemany.com | ES |
| 2026-11-04 | titres-services.net | BE |
| 2026-11-04 | sportschule-steinbach.de | DE |
| 2026-11-04 | fuss-sprunggelenk.de | DE |
| 2026-11-02 | deom.be | BE |
| 2026-10-31 | quevedo-ponce.com | EC |
| 2026-10-31 | mars-semi.com.tw | TW |
| 2026-10-31 | Rood Trucking | US |
Latest 12 of 66, from ransomware.live. These are the group's claims.
Reports about them
- 2026-10-27 DataBreaches.net: FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024
- 2026-10-19 CISA: #StopRansomware: SafePay Ransomware
- 2026-08-31 Sygnia: Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data
Also named in passing in 12 more: Sygnia, Sygnia, DataBreaches.net, Sygnia, Sygnia, CISA, Sygnia, Sygnia, CISA, CISA, CISA, CISA. Those don't feed the techniques or indicators below.
What they exploit
| CVE | Product | KEV | EPSS |
|---|---|---|---|
| CVE-2020-3259 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | yes, ransomware use | 0.715 |
| CVE-2021-44228 | Apache Log4j2 | yes, ransomware use | 1.000 |
| CVE-2023-20269 | Cisco Adaptive Security Appliance and Firepower Threat Defense | yes, ransomware use | 0.266 |
| CVE-2023-27532 | Veeam Backup & Replication | yes, ransomware use | 0.806 |
| CVE-2024-20399 | Cisco NX-OS | yes | 0.043 |
| CVE-2024-40711 | Veeam Backup & Replication | yes, ransomware use | 0.904 |
| CVE-2024-40766 | SonicWall SonicOS | yes, ransomware use | 0.184 |
Sweep
No indicators. Either nobody has published any for safepay, or the reports cite values without marking them as IOCs. package.json