MALWARE FAMILY
SafePay
Internal ID: win.safepay
Last seen:Mar 17, 2026
Intelligence Profile
Malware family identifying win.safepay. Origin and technical characteristics tracked via Malpedia.
Threat Analysis
SafePay is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.
Ransomware Victims (18)
CTIWATCH tracks 18 organizations claimed as victims by SafePay on its data leak site, with attack dates, sectors and countries.
View full victims list →Known Campaigns
safepay_2026
SafePay ransomware campaign 2026 - 2 victims in CA, DE
🎯 Not Found
ACTIVELOW2026
Safepay — Active Campaign March 2026
Safepay is conducting an active ransomware campaign targeting organizations across 3 countries. Primary targets: Healthcare. 3 confirmed victims recorded in the last 45 days. Campaign appears to have stalled.
🎯 Healthcare
LOW2026
External References
Quick Facts
TypeMalware Family
Aliases1
Also Known As
win.safepay
Research Links
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.