Watch Floor
Ransomware

safepay

0mentions, 7 days
0mentions, 30 days
21victims posted, 30 days
nonelast mentioned

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

  • prospecthillcamberwell.com.au
    Nov 4, 2026
  • jhz-bernardshof.de
    Nov 4, 2026
  • ehrenwall.de
    Nov 4, 2026
  • valemany.com
    Nov 4, 2026
  • ruscopackaging.com
    Nov 4, 2026
  • titres-services.net
    Nov 4, 2026
  • sportschule-steinbach.de
    Nov 4, 2026
  • fuss-sprunggelenk.de
    Nov 4, 2026
  • deom.be
    Nov 2, 2026
  • layam.com
    Oct 26, 2026
  • uaa.mx
    Oct 26, 2026
  • quevedo-ponce.com
    Oct 26, 2026
  • mars-semi.com.tw
    Oct 26, 2026
  • grifosespinoza.com
    Oct 26, 2026
  • Rood Trucking
    Oct 26, 2026
  • jumonji-u.ac.jp
    Oct 26, 2026
  • everon.com.ar
    Oct 26, 2026
  • goldencrops.com.tw
    Oct 26, 2026
  • hiqbio.com
    Oct 12, 2026
  • hoteldelfinolugano.ch
    Oct 10, 2026
  • dwi-bau.de
    Oct 10, 2026

A leak-site post is the group's claim, not confirmed by the victim.

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.