The FBI, alongside cybersecurity authorities in Germany and the United Kingdom, issued a joint advisory this week warning that a ransomware group called SafePay has compromised at least 600 organizations across the United States and Europe since it surfaced in late 2024, placing it among the most active extortion operations active right now.
The advisory, which draws on FBI and German law enforcement investigations, marks a significant escalation in attention for a group that operated in relative obscurity before racking up victims at a pace that rivals far better-known criminal networks. The most recent incident cited in the advisory occurred in August.
A Group Built on Borrowed Code
SafePay is not a ransomware-as-a-service operation, meaning it does not rent out its tools to outside affiliates the way groups like RansomHub do. Instead, it runs as a centralized crew, which security researchers say likely keeps operations tighter and reduces the risk of internal leaks.
Its malware, however, did not emerge from nothing. Analysts at Bitdefender and others found that SafePay's ransomware binary closely mirrors a late-2022 version of LockBit's code, with additional elements borrowed from ALPHV and INC Ransom. The group surfaced around the same period that law enforcement actions gutted LockBit in early 2024, and some researchers suspect its members include former Conti or LockBit operators who reconstituted under a new name. A telling technical detail: the ransomware includes a kill switch that deactivates itself on systems with Russian or Cyrillic as the default language, a pattern commonly associated with Eastern European criminal groups trying to avoid prosecution at home.
Getting In and Moving Fast
SafePay gets into networks through a combination of methods. The advisory lists password guessing, phishing, and exploitation of known vulnerabilities, including flaws in Cisco VPN products and Veeam backup software, as primary entry points. The group also buys stolen credentials from initial access brokers on dark web markets and uses automated scripts to scan the internet for exposed systems.
Once inside, the group moves quickly. Attacks have been documented going from initial access to full ransomware deployment in under 24 hours. Operators create new accounts or hijack existing ones, use Windows' own built-in tools to map the network, and disable security software using living-off-the-land techniques that avoid dropping obvious malware. Data is archived with WinRAR or 7-Zip and transferred out via FileZilla or RClone before encryption begins. In some cases, attackers change user passwords to lock out IT staff and slow down the response.
The group has also adopted a social engineering playbook that goes well beyond a simple phishing link. In several documented attacks, SafePay flooded employees with thousands of spam messages to overwhelm their inboxes, then followed up by impersonating IT support over Microsoft Teams or through direct phone calls. Vishing specialists, sometimes hired as a third-party service, would then convince employees to hand over remote access through Microsoft Quick Assist or approve multi-factor authentication prompts.
A Pattern of High-Profile Hits
Three incidents stand out in terms of impact. Government technology contractor Conduent confirmed an attack that disrupted Medicaid payments, child support disbursements, food assistance programs, and roadway tolls in multiple U.S. states. Conduent recently agreed to an $80 million class action settlement over the breach. British transport technology firm Microlise was hit in October 2024, disrupting DHL delivery operations and security systems installed in UK Ministry of Justice prisoner transport vans. In July 2025, researchers linked SafePay to an attack on Ingram Micro, one of the world's largest IT distributors, with analysts estimating the disruption cost the company at least $136 million in daily sales while order fulfillment was offline.
Germany as a Primary Target
Among the countries SafePay has focused on, Germany stands out. During the first quarter of 2025, Check Point Research found that 24 percent of all publicly reported ransomware victims in Germany were attributed to SafePay, the highest concentration of any single ransomware group in any single country during that period. The advisory confirms that dozens of German companies appear on SafePay's dark web leak site alongside government organizations across Latin America and the United States.
Ransom Demands Framed as a Business Transaction
SafePay's ransom notes describe the payment demand as "a subset of company revenue," typically falling between one and three percent of the victim's annual revenue. The group uses cryptocurrency for payments and, according to the advisory, sometimes employs third parties to make phone calls to pressure victims into paying. In cases where paying could expose a victim to regulatory penalties, the group has reportedly offered reduced demands.
The joint advisory stops short of attributing SafePay to any specific country or naming individual suspects.
