{
  "slug": "safepay",
  "group": "safepay",
  "name": "safepay",
  "note": null,
  "attck": [],
  "activity": {
    "postings": 66,
    "first": "2026-08-14",
    "last": "2026-11-04",
    "countries": {
      "AU": 1,
      "DE": 11,
      "US": 9,
      "ES": 5,
      "BE": 4,
      "EC": 1,
      "TW": 2,
      "PE": 2,
      "JP": 2,
      "AR": 2,
      "IL": 1,
      "MX": 3,
      "CH": 8,
      "IT": 3,
      "CL": 1,
      "SK": 1,
      "MY": 1,
      "NL": 1,
      "PH": 2,
      "CZ": 1,
      "LT": 1,
      "AT": 1,
      "PT": 1,
      "CA": 1,
      "KR": 1
    },
    "sectors": {
      "unknown": 20,
      "consumer": 8,
      "manufacturing": 9,
      "services": 7,
      "education": 3,
      "healthcare": 6,
      "transportation": 1,
      "agriculture": 5,
      "technology": 6,
      "government": 1,
      "insurance": 1
    },
    "recent": [
      {
        "date": "2026-11-04",
        "name": "prospecthillcamberwell.com.au",
        "country": "AU",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/cHJvc3BlY3RoaWxsY2FtYmVyd2VsbC5jb20uYXVAc2FmZXBheQ"
      },
      {
        "date": "2026-11-04",
        "name": "jhz-bernardshof.de",
        "country": "DE",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/amh6LWJlcm5hcmRzaG9mLmRlQHNhZmVwYXk"
      },
      {
        "date": "2026-11-04",
        "name": "ehrenwall.de",
        "country": "DE",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/ZWhyZW53YWxsLmRlQHNhZmVwYXk"
      },
      {
        "date": "2026-11-04",
        "name": "ruscopackaging.com",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/cnVzY29wYWNrYWdpbmcuY29tQHNhZmVwYXk"
      },
      {
        "date": "2026-11-04",
        "name": "valemany.com",
        "country": "ES",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/dmFsZW1hbnkuY29tQHNhZmVwYXk"
      },
      {
        "date": "2026-11-04",
        "name": "titres-services.net",
        "country": "BE",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/dGl0cmVzLXNlcnZpY2VzLm5ldEBzYWZlcGF5"
      },
      {
        "date": "2026-11-04",
        "name": "sportschule-steinbach.de",
        "country": "DE",
        "sectors": [
          "education"
        ],
        "url": "https://www.ransomware.live/id/c3BvcnRzY2h1bGUtc3RlaW5iYWNoLmRlQHNhZmVwYXk"
      },
      {
        "date": "2026-11-04",
        "name": "fuss-sprunggelenk.de",
        "country": "DE",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/ZnVzcy1zcHJ1bmdnZWxlbmsuZGVAc2FmZXBheQ"
      },
      {
        "date": "2026-11-02",
        "name": "deom.be",
        "country": "BE",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/ZGVvbS5iZUBzYWZlcGF5"
      },
      {
        "date": "2026-10-31",
        "name": "quevedo-ponce.com",
        "country": "EC",
        "sectors": [
          "unknown"
        ],
        "url": "https://www.ransomware.live/id/cXVldmVkby1wb25jZS5jb21Ac2FmZXBheQ"
      },
      {
        "date": "2026-10-31",
        "name": "mars-semi.com.tw",
        "country": "TW",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/bWFycy1zZW1pLmNvbS50d0BzYWZlcGF5"
      },
      {
        "date": "2026-10-31",
        "name": "Rood Trucking",
        "country": "US",
        "sectors": [
          "transportation"
        ],
        "url": "https://www.ransomware.live/id/Um9vZCBUcnVja2luZ0BzYWZlcGF5"
      }
    ]
  },
  "convergences": [],
  "reports": [
    {
      "url": "https://www.sygnia.co/blog/investigating-data-extortion-involving-trusted-vendor-access/",
      "publisher": "Sygnia",
      "published": "2026-11-01",
      "title": "Investigating Data Extortion Involving Trusted Vendor Access",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.sygnia.co/blog/best-practices-incident-response/",
      "publisher": "Sygnia",
      "published": "2026-10-28",
      "title": "Incident Response Best Practices: Strategies, Tools & Plans",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://databreaches.net/2026/10/27/conduent-to-pay-80m-to-settle-3rd-largest-healthcare-data-breach/",
      "publisher": "DataBreaches.net",
      "published": "2026-10-27",
      "title": "Conduent to pay $80M to settle 3rd-largest healthcare data breach",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://databreaches.net/2026/10/27/fbi-says-safepay-ransomware-gang-among-most-active-with-more-than-600-victims-since-2024/",
      "publisher": "DataBreaches.net",
      "published": "2026-10-27",
      "title": "FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/threat-reports-and-advisories/php2shell-two-critical-php-vulnerabilities-expose-web-servers-to-remote-code-execution/",
      "publisher": "Sygnia",
      "published": "2026-10-22",
      "title": "php2shell: Two Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a",
      "publisher": "CISA",
      "published": "2026-10-19",
      "title": "#StopRansomware: SafePay Ransomware",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.sygnia.co/press-release/sygnia-expands-global-mdr-operations-austin-singapore-soc-hubs/",
      "publisher": "Sygnia",
      "published": "2026-10-11",
      "title": "Sygnia Unveils Security Operations Center Hubs and Expands AI-Powered Cybersecurity Capabilities To Challenge Threat Attack Rise",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a",
      "publisher": "CISA",
      "published": "2026-10-06",
      "title": "Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.sygnia.co/threat-reports-and-advisories/actively-exploited-netscaler-vulnerabilities/",
      "publisher": "Sygnia",
      "published": "2026-09-28",
      "title": "Actively Exploited NetScaler Vulnerabilities",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.sygnia.co/blog/shai-hulud-in-the-wild-what-security-and-incident-response-teams-need-to-know/",
      "publisher": "Sygnia",
      "published": "2026-09-06",
      "title": "Shai-Hulud in the Wild: What Security and Incident Response Teams Need to Know",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a",
      "publisher": "CISA",
      "published": "2026-09-04",
      "title": "China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.sygnia.co/blog/how-the-safepay-ransomware-group-abused-onedrive-to-steal-data/",
      "publisher": "Sygnia",
      "published": "2026-08-31",
      "title": "Exfiltration in Plain Sight: How the SafePay Ransomware Group Abused OneDrive to Steal Data",
      "origin": "feed",
      "primary": true
    },
    {
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a",
      "publisher": "CISA",
      "published": "2026-08-20",
      "title": "A Tale of Two SOCs: Insights From Two Red Team Assessments",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a",
      "publisher": "CISA",
      "published": "2026-08-14",
      "title": "Defending Against an Active Threat to Siemens S7 Series PLCs",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a",
      "publisher": "CISA",
      "published": "2026-08-05",
      "title": "#StopRansomware: Gunra Ransomware",
      "origin": "feed",
      "primary": false
    }
  ],
  "techniques": [],
  "cves": [
    {
      "id": "CVE-2020-3259",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.715,
      "vendor": "Cisco",
      "product": "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)"
    },
    {
      "id": "CVE-2021-44228",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.99999,
      "vendor": "Apache",
      "product": "Log4j2"
    },
    {
      "id": "CVE-2023-20269",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.26623,
      "vendor": "Cisco",
      "product": "Adaptive Security Appliance and Firepower Threat Defense"
    },
    {
      "id": "CVE-2023-27532",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.80599,
      "vendor": "Veeam",
      "product": "Backup & Replication"
    },
    {
      "id": "CVE-2024-20399",
      "in_kev": true,
      "ransomware_use": false,
      "epss": 0.04306,
      "vendor": "Cisco",
      "product": "NX-OS"
    },
    {
      "id": "CVE-2024-40711",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.90369,
      "vendor": "Veeam",
      "product": "Backup & Replication"
    },
    {
      "id": "CVE-2024-40766",
      "in_kev": true,
      "ransomware_use": true,
      "epss": 0.18379,
      "vendor": "SonicWall",
      "product": "SonicOS"
    }
  ],
  "indicators": {
    "list": [],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 0,
    "defendable": 0,
    "covered": 0,
    "uncovered": []
  }
}