The SafePay ransomware group has been highly active since August 2024, targeting organizations globally. They gain initial access through compromised credentials, password guessing, exploiting vulnerabilities, and phishing. Once inside, SafePay actors create or compromise accounts and use legitimate system tools for network traversal and disabling security measures. They then encrypt victim data, demanding cryptocurrency for decryption. Vulnerabilities like CVE-2020-3259, CVE-2023-20269, and others are exploited for initial access. SafePay employs "living off the land" techniques, using existing system tools for persistence, execution, and lateral movement. They disable security software and exploit privilege escalation methods like UAC bypass. Data is collected and exfiltrated using tools like FileZilla, RClone, and WinSCP. Volume Shadow Copy Service and backup storage are targeted to hinder recovery. Encryption is achieved through a hybrid scheme rendering data unrecoverable without the key. A ransom note with a TOR link and victim ID is left, and phone calls may be made to pressure victims. If payment is not made, stolen data is often posted online. Recommended mitigation includes regular patching, Zero Trust principles, restricted privileges, and multi-factor authentication.