Inside SafePay: Analyzing the New Centralized Ransomware Group

SafePay is a centralized ransomware group that emerged in late 2024, distinguishing itself from RaaS models by maintaining strict control over operations and employing double extortion tactics. The group gains initial access through compromised credentials or misconfigured firewalls, evades defenses by disabling security software and deleting shadow copies, and exfiltrates data before encryption, with attacks often completing within 24 hours.