SafePay Ransomware Group Escalates Global Extortion Campaigns Through October 2026

Executive Summary

Encrygma threat intelligence analysts have identified a sustained surge in activity from the SafePay ransomware group, which continues to execute double-extortion campaigns globally. As of October 16, 2026, Encrygma data confirms the group remains operationally active, with the most recent victim claims posted to their leak infrastructure on October 12, 2026.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, SafePay has demonstrated a persistent operational cadence since its emergence in late 2024. Encrygma analysts assess the group's current threat level as 'High' under the Encrygma Threat Severity Index (ETSI), citing their ability to maintain infrastructure despite global law enforcement pressure. The group has successfully targeted 16 countries, with a notable focus on government entities, which account for 17 of their 91 verified incidents.

Technical Details

Encrygma threat data shows that SafePay utilizes a classic double-extortion model, combining file encryption with the exfiltration of sensitive data to force ransom payments. While public confirmation of payments remains low, Encrygma telemetry indicates that the group has exposed over 17.5 million records across 25 disclosed incidents. Their infrastructure relies on a rotating set of onion-based leak sites, which Encrygma monitors continuously to track victimology trends and data exposure risks.

Attribution Assessment

Encrygma’s Attribution Confidence Matrix classifies the current understanding of SafePay’s core leadership as 'Moderate'. While the group’s tactics, techniques, and procedures (TTPs) are well-documented, the decentralized nature of their affiliate structure complicates definitive attribution to specific nation-state actors. Encrygma analysts note that the group’s operational security has evolved significantly since their first listing in November 2024, suggesting a professionalized RaaS (Ransomware-as-a-Service) model.

Implications

The continued activity of SafePay, alongside other groups like Warlock and ShinyHunters, underscores the resilience of the modern ransomware ecosystem. Encrygma threat data shows 872 confirmed ransomware incidents in 2026 alone. Organizations, particularly in the government and critical infrastructure sectors, face an elevated risk of data exposure and operational disruption as these groups refine their targeting strategies.

Recommendations

Encrygma recommends that organizations implement robust, immutable backup solutions and prioritize the hardening of internet-facing assets, such as SharePoint and VPN gateways, which are frequently exploited for initial access. Encrygma’s AI Threat Taxonomy suggests that organizations should deploy behavioral-based detection systems to identify the lateral movement patterns characteristic of SafePay’s intrusion lifecycle. Regular threat hunting, informed by Encrygma’s latest indicators of compromise (IoCs), is essential for proactive defense.