← threat actors
threat actor · not yet in the cluster map
safepay
also tracked as play 1, qilin 1, ralord 1, redact 1, settra 1
2 stories · 2 in the wild · June 29, 2026 – October 21, 2026
evidence: 2 observed
how they got in
- exposed service 1 · Oct 21
- phishing email 1 · Oct 21
- stolen credentials 1 · Oct 21
geography
- germany 1 · Jun 29
- united states 1 · Jun 29
techniques
- credential compromise 1 · Oct 21
- data exfiltration 1 · Oct 21
- encryption 1 · Oct 21
- exploitation 1 · Oct 21
- lateral movement 1 · Oct 21
- phishing 1 · Oct 21
attack phases seen
- Impact 2 · Oct 21
- Collection 1 · Oct 21
- Defense evasion 1 · Oct 21
- Initial access 1 · Oct 21
- Lateral movement 1 · Oct 21
what we reported, newest first, grouped by story
October 21, 2026
- SafePay has breached at least 600 organizations since August 2024. A joint US, UK and German advisory calls it one of 2026’s most active ransomware groups. Initial access includes stolen or guessed credentials, phishing and exploited perimeter flaws such as CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766; operators then create or hijack accounts, disable defenses, use legitimate remote tools, exfiltrate data and encrypt systems. See the CISA advisory.
· Oct 21 · observed · via stolen credentials · Threat Activity
June 29, 2026
- Ransomware churn: SafePay climbed from 22 to 59 victims quarter-over-quarter (+168%) — including German logistics firm Hellmold & Plank — and RALord (Nova) jumped to 60 (+329%); new leak-site brands SETTRA ("if there is access, there is a target") and REDACT appeared, while Qilin and PLAY added several US victims. (Ido Cohen, Dark Web Informer)
· Jun 29 · observed · as ralord, settra, redact, qilin, play · Threat Activity