SafePay Ransomware’s Rapid Ascent to the Top of the Cybercrime Scene

SafePay, a rapidly rising ransomware group that emerged in September 2024, has quickly become one of the most aggressive and active cybercriminal groups in 2025, responsible for over 200 attacks. Targeting industries such as managed service providers (MSPs) and small-to-medium businesses (SMBs), SafePay’s attacks primarily focus on the United States, Germany, and other regions, while avoiding CIS countries. Unlike Ransomware-as-a-Service models, SafePay operates privately, maintaining tight control over its attacks and consistently high-impact operations.