SafePay is a Windows file-encrypting strain that renames affected files with a .safepay suffix and places a text note called readme_safepay.txt in each encrypted folder. The note opens with a greeting, frames the breach as a lesson in poor network configuration, and directs the victim to a Tor chat portal or a TON-hosted blog, with a two-week window before publication begins. Activity dates from autumn 2024 and focuses on mid-sized and large organisations, frequently entered through exposed remote access with weak or reused credentials. Intrusions have shown archiving and file-transfer tooling deployed ahead of encryption, and the group runs a leak site for victims who refuse to pay. Code analysis ties the encryptor closely to the leaked LockBit Black builder, with added features such as a kill switch for systems using Cyrillic keyboard layouts.
File extensions: .safepay
Ransom note filenames: readme_safepay.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161