Written by: DarkWebSonar Research Team
SafePay is a double-extortion ransomware operation DarkWebSonar has tracked since 15 November 2024. The sharpest signal in the telemetry is not the encryptor. It is the victim map: of 598 leak-site listings, 37% name United States organizations and 21% name German ones, and 28% sit in Manufacturing & Construction. That US-plus-Germany industrial concentration is sharper than the global mix we document for Qilin and The Gentlemen, two other enterprise-ransomware operations we track.
SafePay is already well documented by security vendors. What the leak-site record adds is time depth: two years of claimed victims shows which countries, sectors, and company sizes the group keeps returning to, and how its activity arrives in waves rather than a steady stream. Every organization named below is a claim SafePay published on its Tor leak site, not a compromise independently confirmed by DarkWebSonar.
Key findings from DarkWebSonar telemetry (through 2026-10-20):
- 598 leak-site listings since 2024-11-15; last listing 2026-10-12. Attack-type mix is 590 ransomware (99%) and 8 data-breach records (1%).
- United States 222 (37%) and Germany 127 (21%) together account for 58% of listings, across 44 countries.
- Top industry: Manufacturing & Construction at 168 listings (28%), more than three times Healthcare & Pharma (53, 9%).
- Activity classification: Steady. 25 listings in the last 30 days (up from 22 in the prior 30 days), 68 in the last 90 days, 0 in the last 7 days.
- Recent publication is batched: 10 listings on 2026-10-05 (2026-W41), including a claimed listing for T-Systems (t-systems.com).
SafePay emerged in late 2024 as a centralized ransomware operation: a closed group that runs no public affiliate program (non-RaaS), encrypts with a .safepay extension, and runs double extortion (encrypt plus leak). Its locker is built on the leaked LockBit Black builder but operates independently of LockBit's crew (Bitdefender, Check Point, FortiGuard). The encryptor aborts on Cyrillic-language systems, the usual tell of a Russian-speaking or CIS-based crew; no identity has been confirmed and no law-enforcement attribution exists.
By the Numbers (DarkWebSonar Telemetry)
DarkWebSonar monitors SafePay's Tor leak site continuously. The 598 listings below are what the group chooses to publish. Posting volume is a useful proxy for extortion activity, though it undercounts organizations that pay quietly or are never named.
- Total listings: 598 across 44 countries; United States 37% and Germany 21% dominate the map
- Recent momentum: 25 of 598 listings landed in the last 30 days; 68 in the last 90 days
- DarkWebSonar risk score: 95 / 100 (High)
- Activity classification: Steady, meaning recent 30-day volume is in line with the group's established cadence rather than a spike
- Primary network: dark web (Tor) leak site, 100% of listings
- Attack-type mix: Ransomware 590 (99%), Data Breach 8 (1%)
Posting cadence and year-week analysis
SafePay does not drip listings evenly. DarkWebSonar's monthly series is lumpy, and ISO-week aggregation of individual listing dates shows the same batch pattern.
Peaks, not a single debut. Monthly highs sit at May 2025 (73 listings) and December 2025 (68). The largest single day in the entry set is 2025-03-30 (2025-W13), with 30 listings. Other double-digit drop days include 2025-06-14 (14), 2025-05-11 (13), and 2025-07-07 (12). Bitdefender's September 2025 analysis independently names March 30, 2025 as SafePay's single biggest day (29 claimed victims); DarkWebSonar records 30 listings on that date.
Lumpy, not dormant. 2026 has not been uniformly quiet: after a February trough of 3 listings, monthly counts run Mar 8, Apr 9, May 30, Jun 21, Jul 33, Aug 12, Sep 32, Oct 13 (through 2026-10-12), so mid-year months (May and July) rival 2025's cadence. The last 7 days are empty. We assess the gaps as the downswing of a publication cycle: the 2026-10-05 batch put 10 names on the site in one day, then Hi-Q (Taiwan) on 2026-10-12, then silence. A quiet week is not evidence the operation retired.
The spike is a publication artifact. Ten listings on 2026-10-05 does not mean ten same-day intrusions. Leak-site counts track when organizations are named. A one-day burst is batch publishing of accumulated claims. The defender takeaway is the one the Gentlemen profile made too: monitoring the site beats waiting for a news spike.
Targeting distribution: countries
A 21% German share is the distinctive geographic fact. Most high-volume ransomware datasets DarkWebSonar publishes are far more US-dominant (Qilin at 50% United States; The Gentlemen at 25% United States with Germany in the mid-single-digit listing counts). SafePay's map is a Western-enterprise operation: DACH plus the Anglosphere, not an opportunistic global sprayer.
The long tail is also Western-Europe heavy (Austria, Netherlands, Belgium, France). That footprint is US and German mid-market industrials, with healthcare and education behind them, the organizations most exposed to this group.
Targeting distribution: industries
Manufacturing & Construction is the clear first sector at 168 listings (28%), more than three times the next bucket. Healthcare & Pharma (9%) and Education & Research (7%) follow, then Professional Services (6%) and Technology & Telecom (5%). The mix is manufacturing-first mid-market: firms with real downtime cost and often thinner security teams than global enterprises. That profile, not the global enterprise, is who most needs SafePay on a monitoring list.
Tactics, Techniques & Procedures (TTPs)
DarkWebSonar visibility begins at the leak site. The techniques below are inferred from listing class and tagged metadata, not observed in victim networks or host forensics. Initial-access tradecraft and social-engineering pressure come from incident-response reporting, which we attribute as such.
Extortion strategy
SafePay runs a ransomware-centric double-extortion model. T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery), and T1027 (Obfuscated Files or Information) are inherent to that model, so we infer them across the 590 ransomware-classified listings rather than confirming them listing by listing.
Beyond encryption, a minority of listings carry tags for internal defacement and data manipulation (T1491.001, T1565.003, T1565.001) and for financial-theft framing (T1657); a smaller subset carry collection and exfiltration tags (T1041, T1005, T1530, T1537), consistent with steal-then-encrypt tradecraft rather than encryption-only. These are inferred from the listing, not per-incident host detections.
On disk, SafePay encrypts files with a .safepay extension and drops a readme_safepay.txt note that gives victims 10 days to make contact before it publishes their data.
Initial access and pressure tactics
Access typically arrives through valid credentials over RDP or VPN gateways, and the window from breach to encryption is often under 24 hours. SafePay pairs the intrusion with a social-engineering overlay: inbox flooding (thousands of messages in minutes), then voice or Microsoft Teams contact impersonating IT support, sometimes steering the target onto a legitimate remote-support tool such as Quick Assist. This procedure comes from incident responders (Huntress, Check Point, Barracuda), who see the victim-network detail our leak-site view does not. The matching capability tags in DarkWebSonar's profile are T1133 (External Remote Services), T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts), and T1566.002 (Spearphishing Link), carried as capabilities rather than per-incident confirmations.
Status
No public law-enforcement takedown, arrest, or leak-site seizure targeting SafePay has been identified as of 21 October 2026. The group remains operationally active on Tor.
Evolution & Trends
- Late 2024: First activity dates to September–October 2024. DarkWebSonar's first listing is 2024-11-15 (32 listings that month). Huntress published the early incident-response picture in November 2024.
- 2025-W13 / May–July 2025: First large publication bursts (30 listings on 2025-03-30; May monthly peak of 73). Check Point ranked SafePay among the more prevalent Q1 2025 brands on public claims.
- 2025-W51–W52: Second monthly peak (December 2025, 68 listings).
- 2026: The same batch shape continues, not a decline (May 30, July 33, and September 32 the high months; February 3 the low). 2026-W41 opened with a 10-listing day on 2026-10-05, then a single Taiwan listing on 2026-10-12.
We assess the 2025 peaks as accumulated publication dumps rather than a change in victimology. Country and industry shares are stable across 598 listings, which is a signature, not a one-month artifact. Continuity into October 2026, including a Deutsche Telekom-subsidiary claim, supports treating SafePay as a standing industrial-ransomware problem for US and German SOCs, not a 2025-only brand.
Notable Campaigns / Victims
A few of the larger or more recent names, all claimed on SafePay's leak site:
- T-Systems (Germany, Professional Services; 2026-10-05; t-systems.com). Deutsche Telekom's IT-services subsidiary and the marquee name in the October batch. Deutsche Telekom acknowledged the incident while playing down its scope: a spokesperson told Cybernews that ransomware "was found on a small test system, isolated and cleaned up before any significant damage could occur," and that the stolen data "does not contain any sensitive information." Read SafePay's listing against that account rather than as a confirmed enterprise-wide breach.
- DWI Bausysteme (Germany, Manufacturing & Construction; 2026-10-09). Metal roof and façade construction, a typical German Mittelstand industrial target.
- Grundéns (United States; 2026-10-05; grundens.com). Fishing-apparel maker founded in 1911; the listing carries company history consistent with claimed exfiltration.
- Hi-Q (Taiwan, Manufacturing & Construction; 2026-10-12; hiqbio.com). Marine biotech manufacturer, the most recent listing in this pull.
The rest of the October batch is the same shape at smaller scale: more German industrials (BWI-Bau, Wolf & Sofsky), US mid-market firms (Marlin Mechanical, Compunnel, Triniti), and a DACH-and-neighbors SMB tail across Switzerland, Austria, Italy, and Slovakia. The story is the pattern, mid-market industrials and services concentrated in the US and the German-speaking world, not any single listing.
DarkWebSonar Insights
- Germany, not only the US. A 21% German share (127 listings) is unusual among high-volume ransomware profiles we publish. Pair it with the T-Systems claim and the string of German Bau and industrial SMB listings, and the picture is a crew that works the German industrial Mittelstand as well as US mid-market, not a US-only sprayer.
- Manufacturing concentration matches Qilin and The Gentlemen, geography does not. SafePay's 28% Manufacturing & Construction share is the same bucket we flag for The Gentlemen (28%) and close to Qilin (25%). Industrial SOCs should read the three together. SafePay is the one whose listings skew US-plus-Germany rather than US-global or US-plus-long-tail.
- Year-week cadence tracking separates true quiet from batch-drop weeks. October's empty last 7 days sit next to a 10-listing day on 2026-10-05. Monthly rollups hide that shape.
- Completeness, then history. A cross-check against public leak-site catalogs on this pull lines up with DarkWebSonar's listing count, so the value is the two-year country and industry pattern rather than any single name one feed caught and another missed.
Defender Outlook 2026
Persistent risk: US and German organizations in Manufacturing & Construction, Healthcare & Pharma, Education & Research, Professional Services, and Technology & Telecom should treat SafePay as an active double-extortion threat. Canada and the UK are the next most listed geographies. Mid-market industrials and construction-adjacent firms match the named-listing mix.
Tempo: Output arrives in ISO-week batches (2025-W13, W19, W22, W51–W52; 2026-W41) with quiet troughs between dumps. Detection and leak-site alerting need to stay on during the quiet weeks. Sub-24-hour encryption timelines raise the cost of delayed containment once access exists.
Defensive actions:
- Lock down internet-facing RDP, VPN, and other remote access. Enforce phishing-resistant MFA, restrict exposure, and watch for valid-account abuse (T1133, T1078).
- Patch internet-facing apps and appliances on a short cycle. DarkWebSonar's profile associates SafePay with CVE-2023-22518 (Confluence), CVE-2023-42793 (TeamCity), CVE-2023-36884, CVE-2023-38408, CVE-2017-0199, and CVE-2017-10271. Treat those as capability tags, not proven entry on every incident.
- Brief help desks and staff on email-bombing plus vishing or Teams impersonation of IT, including unsolicited Quick Assist or similar remote-support tools.
- Hunt for share discovery (ShareFinder /
Invoke-ShareFinder), unusual WinRAR/7-Zip staging, and FileZilla or RClone outbound as pre-encryption tells. - Validate backup isolation and test restoration from offline or immutable copies. Recovery inhibition (T1490) is inherent to this ransomware model.
- Monitor large outbound transfers and cloud-exfil patterns (T1041, T1537) as early double-extortion indicators.
- Establish leak-site early warning for your organization, subsidiaries, and key suppliers. For a batch-posting group, the listing is often the first external signal.
Threat Intelligence Indicators
DarkWebSonar CVE associations in SafePay's profile (capability tags, not per-listing exploit confirmations):
- CVE-2023-22518 (Atlassian Confluence improper authorization)
- CVE-2023-42793 (JetBrains TeamCity authentication bypass)
- CVE-2023-36884 (Microsoft Windows search-path / Office spoofing class issue)
- CVE-2023-38408 (OpenSSH PKCS#11 helper)
- CVE-2017-0199 (Microsoft Office / WordPad RTF)
- CVE-2017-10271 (Oracle WebLogic wls-wsat)
Operational indicators from leak-site monitoring: Tor publication in multi-name same-day batches; 99% ransomware categorization; manufacturing-heavy industry metadata; concurrent US and German names in single drop days; .safepay / readme_safepay.txt in host-based reporting.
Conclusion
SafePay has quietly listed 598 organizations in two years, with 58% of those names in just two countries (United States 37%, Germany 21%) and 28% in manufacturing and construction. For defenders, the practical signal is the victimology, not the internals of a LockBit-derived encryptor. Read this profile next to Qilin and The Gentlemen if industrial leak-site exposure is already on your list.
For CTI and SOC teams, the exposure pattern is addressable: exposed RDP and VPN without enforced MFA, unpatched internet-facing apps, help-desk vishing during inbox floods, untested backups, and no leak-site early warning for the organization or its German and US suppliers. Closing those gaps is the highest-value control stack against this group.
Data notes: Figures come from DarkWebSonar's continuous monitoring of SafePay's Tor leak site, current to 2026-10-20, except where attributed to incident-response reporting. Every named organization is a claimed listing, not a compromise DarkWebSonar has independently confirmed.
👉 Dark Web Most Wanted profiles are powered by DarkWebSonar's continuous monitoring of ransomware leak sites. Want real-time visibility into groups like SafePay? Contact Sales.
